1. Home
  2. Cisco Systems
  3. Cisco 827 inetnal server NAT problem

Cisco 827 inetnal server NAT problem

I can't seem to get my Cisco 827 router to allow incoming connections to the http port on an internal server with private IP. I configured NAT like this:

ip nat inside source static tcp 192.168.0.1 80 interface Dialer0 80

and this should open up and forward port 80 in theory, but it doesn't. I read all kinds of docs and group posts and it seems that I'm doing everything right. Or am I? My ISP is Tiscali and I have a dynamic public IP. Could this pronlem be linked to something at my ISP? I'm currently running a web server (with DydDNS) using Alcatel Speed Touch Home ADSL modem and have no problems there (no NAT or port forwarding with this), but when I hook up the Cisco827 I can't open any incoming ports. I even moved the router's integrated web server to port 8080 to avoid any conflicts. Here's my config, can anyone please tell me what is possibly wrong with it:

version 12.1 no service pad service timestamps debug uptime service timestamps log uptime no service password-encryption ! hostname Router ! enable secret 5 encrypted.pw.here ! ip subnet-zero ! interface Ethernet0 ip address 192.168.0.75 255.255.255.0 ip nat inside ! interface ATM0 no ip address no atm ilmi-keepalive pvc 8/35 encapsulation aal5mux ppp dialer dialer pool-member 1 ! bundle-enable dsl operating-mode auto ! interface Dialer0 ip address negotiated ip nat outside encapsulation ppp dialer pool 1 ppp chap hostname user.nane.here ppp chap password 7 encrypted.pw.here ppp pap sent-username user.nane.here password 7 encrypted.pw.here ! interface Dialer1 no ip address no cdp enable ! ip nat inside source list 1 interface Dialer0 overload ip nat inside source static tcp 192.168.0.1 80 interface Dialer0 80 ip classless ip route 0.0.0.0 0.0.0.0 Dialer0 no ip http server ip http port 8080 ! access-list 1 permit 192.168.0.0 0.0.0.255 ! line con 0 exec-timeout 0 0 transport input none stopbits 1 line vty 0 4 password pw.here login ! scheduler max-task-time 5000 end

Thanks in advance

Reply to
congoclash
Loading thread data ...

Hi,

Do you have any inbound access-lists in place that could be blocking port 80?

Rob

Reply to
RobO

Not that I know, I posted the full output of my show running-config command and there's only one explicidly defined access-list:

access-list 1 permit 192.168.0.0 0.0.0.255

What else should I check?

RobO wrote:

Reply to
congoclash

Apologies I did not think it was the full output.

Another access-list will need to be setup on the dialer interface in the inbound direction. I noticed you are running IOS 12.1 so I am not sure exactly what features are available to that version so I will post an access-list that should be compatible.....hopefully!

access-list 101 permit udp host your_isp_dns_server1_ip eq 53 any access-list 101 permit udp host your_isp_dns_server2_ip eq 53 any access-list 101 permit tcp any any established access-list 101 permit tcp any any eq 80 access-list 101 deny tcp any range 0 65535 any range 0 65535 log access-list 101 deny udp any range 0 65535 any range 0 65535 log access-list 101 deny ip any any

Then apply the ACL to the dialer interface in the inbound direction:

int d1 ip access-group 101 in

This ACL should be sufficient to get you started but is not entirely safe. Ill try and run through it with you line by line.

As I mentioned Im not sure what features 12.1 supports so this is the reasoning behind this ACL.

The first 2 lines allow DNS queries to be returned back to you. The 3rd line permits tcp sessions back into the network that were initiated from the inside. Then the line to permit http access. Then I split up the TCP and UDP entries so you can get an indication in the logs as to what is being blocked. Then an implicit deny at the end just for show.

Hope this helps,

Rob

Reply to
RobO

Another thing!

Not sure if its supported but add the keyword "extendable" at the end of the NAT statement:

" ip nat inside source static tcp 192.168.0.1 80 interface Dialer0 80 extendable"

Also the ACL I posted apply it to interface Dialer 0 not Dialer 1 as I posted.

Rob

Reply to
RobO

You may find the Cisco Config Wizard helpful:

formatting link
Sincerely,

Brad Reese BradReese.Com=AE Cisco Resource Center Toll Free: 877-549-2680 International: 828-277-7272=20 Website:

formatting link

Reply to
BradReeseCom

Many thanks for your help, what you suggested makes sense. I introdused the new access list and did everything you said but still no go. The "extendable" at the end of the NAT statement is not supported on IOS

12.1. I'm now see> Apologies I did not think it was the full output.
Reply to
congoclash

Cabling-Design.com Forums website is not affiliated with any of the manufacturers or service providers discussed here. All logos and trade names are the property of their respective owners.