0

Cisco packet tracer setup

Suppose I have the following network layout, with two routers connected directly, with Port Address Translation (PAT) setup on both of them. The first router labelled Router PAT 1 have been configured to have inside global address of 50.0.0.1 with the following commands:

Router(config)#access-list 1 permit any
Router(config)#ip nat pool MY_POOL 50.0.0.1 50.0.0.1 netmask 255.0.0.0
Router(config)#ip nat inside source list 1 pool MY_POOL overload
Router(config)#interface gi0/0
Router(config-if)#ip nat outside
Router(config-if)#interface gi0/1
Router(config-if)#ip nat inside

The second router labelled Router PAT 2 have been configured with inside global address of 51.0.0.1 with the following commands:

Router(config)#access-list 1 permit any
Router(config)#ip nat pool MY_POOL 51.0.0.1 51.0.0.1 netmask 255.0.0.0
Router(config)#ip nat inside source list 1 pool MY_POOL overload
Router(config)#interface gi0/0
Router(config-if)#ip nat outside
Router(config-if)#interface gi0/1
Router(config-if)#ip nat inside

Take note that I have configured the necessary routing on both router.

I am trying to connect PC0 on the side of the second router with the Server0 behind the first router using both ICMP ping and HTTP request via the web browser; using ping 192.168.1.1 and accessing http://192.168.1.1 respectively.

When using the simulation mode, the packet is properly transferred from PC0 to Server0 and back to Router PAT 2 before being stuck there. The source IP address is 50.0.0.1:<PORT> and the destination IP address is 51.0.0.1:<PORT>. I have checked the NAT table on Router PAT 2 and confirmed that the entry for 51.0.0.1:<PORT> is available and is mapped to the local address of 193.168.1.1:<PORT>. However, the NAT on the router doesn't translate it, and end up giving an error of host unreachable.

My idea of why the translation doesn't work is that the source IP address is 50.0.0.1:<PORT>, which doesn't match up with the outside local and global addresses in the NAT table (192.168.1.1:). Hence, its blocked. Perhaps, some security feature? Hope someone is able to advice me on this.

Improve this question

1 Answer 1

Reset to default
3

You cannot use private addresses as destination across NAT.

You need to either use port forwarding aka destination NAT aka reverse NAT on the NAT router and use the router's public address as destination, or you need to establish a tunnel between the routers to enable transparent routing.

Without a public address domain (=open Internet) between the routers you should dispose of NAT and use transparent routing.

Improve this answer
5
  • Thanks for your reply, I understand the issue now. However, just wanted to confirm too whether or not the source IP address must match the NAT’s configuration for the outside local and global addresses?
    – Jarrett GXZ
    Commented Mar 13 at 14:16
  • "The source IP address" - where? It's translated by source NAT from private LAN to public network.
    – Zac67 ♦
    Commented Mar 13 at 14:31
  • Assuming the source NAT receives a rogue packet with the destination IP address and port number matching an entry in the NAT table (somehow it guesses it right), will the NAT router accept the packet even if the source IP of the packet doesn’t match the outside local and global addresses in the NAT table? I was just wondering from a security point of view.
    – Jarrett GXZ
    Commented Mar 14 at 0:24
  • Depending on the NAT/NAPT implementation of the router, it may re-use public-facing port numbers, and it most often includes the remote IP and port in its mapping - so no, it won't usually accept rogue packets happening to match a destination port in its translation table.
    – Zac67 ♦
    Commented Mar 14 at 3:32
  • So what’s the reason the router won’t accept the rogue packet?
    – Jarrett GXZ
    Commented Mar 14 at 4:07

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.