1

I have a couple of rather basic questions about NAT translation.

For a simple translation like:

ip nat inside source list ACL interface GigabitEthernet 0 overload

If the traffic does not match ACL, it will go out untranslated. So why not just make ACL permit ip any any?

In the case which the outside interface is the WAN, it would waste bandwidth if this traffic went out, either translated or un-translated. So, is there a way to block traffic not translated by NAT from going out? I have tried applying an output ACL on the interface but it ended up blocking even NAT translated traffic.

Improve this question
1
  • Did any answer help you? If so, you should accept it so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you could provide and accept your own answer.
    – Ron Maupin ♦
    Feb 21, 2018 at 14:25

4 Answers 4

Reset to default
1

Suppose you are a business with several blocks of public address space. You want to conserve that address space for your public-facing servers, but your employees get private addressing for their PCs. In this case, you want to NAT the PCs, but not any of the public addressing.

You seem to be thinking like a residential ISP customer, but the Cisco routers are really aimed at businesses, which often have blocks of public addressing. NAT is a kludge to be used only when you must. There is no reason to NAT everything that passes through an interface, and it is often desirable not to.

As far as blocking certain traffic from going out an interface, you are going to need to be much more detailed about what you mean, what you have tried, and why you think it didn't work.

Improve this answer
0

No ! Generally access -list is configured in such way that outbound traffic initiated from LAN subnets only

Assuming LAN subnet ip pool is 10.40.1.0/24

Then access list would be

Router(config)#access-list 100 permit 10.40.1.0 0.0.0.255 any

Router(config)#ip nat inside source list 100 interfàce gigabit Ethernet 0/0 overload

So there will be no untranslated outbound traffic because traffic will only initiate from LAN subnet 10.40.1.0/24 so this traffic matches access-list and this translates private ip address to public ip address .

Improve this answer
2
  • The issue is that untranslated traffic will still go out, untranslated. In reality, there are usually more than two subnets on a router. I could enable VRF and Unicast RPF to limit the route and source. But this makes the config over complicated.
    – some user
    Jan 23, 2021 at 17:38
  • If your are having two subnet then make sure create two access-list . Don't leave any traffic going outside interface untranslated
    – Sagar Uragonda
    Jan 24, 2021 at 8:00
0

The reason is that you want to be sure that you don't accidentally nat something you do not want to be natted.

Improve this answer
-1

Correct answer on your question would be two ACL's: one is for actual NAT, and another - outgoing ACL from your WAN interface.

ip access-list extended ACL-NAT
 deny ip any 10.0.0.0 0.255.255.255
 deny ip any 172.16.0.0 0.15.255.255
 deny ip any 192.168.0.0 0.0.255.255
 <HERE YOUR DETAILED RULES THAT ALLOW TRAFFIC TO INTERNET OR permit ip any any>

ip access-list extended ACL-WAN-OUT
 deny ip 10.0.0.0 0.255.255.255 any
 deny ip 172.16.0.0 0.15.255.255 any
 deny ip 192.168.0.0 0.0.255.255 any
 permit ip any any


ip nat inside source list ACL-NAT interface GigabitEthernet 0 overload
interface GigabitEthernet0
 ip access-group ACL-WAN-OUT out
Improve this answer
3
  • I think you meant to say "permit ip ..." in your ACL-NAT.
    – some user
    Nov 26, 2017 at 3:50
  • @someuser no, I don’t
    – Andrey Prokhorov
    Nov 26, 2017 at 22:35
  • @someuser ok, let me explain. ACL-NAT it's your ACL that decides who will be NATted and who will be not. And in first three rules we're denying translation to RFC 1918 networks (local addresses). Then you can replace my <HERE YOUR DETAILED RULES...> line and insert something like permit tcp any any eq 80 443, that will allow HTTP/HTTPS from your any local IP to any external IP. And after ACL-WAN-Out comes in. Here we're denying any LOCAL IP to get out untranslated from your WAN interface, which is GigabitEthernet 0.
    – Andrey Prokhorov
    Apr 23, 2018 at 7:25

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.