If an outside client reaches the public proxy address but a LAN client cannot, compare the two paths. Inbound forwarding and hairpin NAT are separate router features.

Hairpinning takes an internal request to the public mapping back to the internal service. Without that route, local clients can use the proxy host's reachable LAN address instead. Keep it stable with the network's intended reservation/address policy and verify the listener accepts it.

Split DNS can keep one hostname while returning private and public addresses on the appropriate networks. This also preserves the certificate hostname for a TLS proxy.

A changing public IP is another issue. Fixing internal hairpin access does not refresh external DNS or its public port mapping.

Artihkkalat mat laktásit