9

I have a Cisco router configured NAT (4 static NAT and dynamic NAT). My problem is that I can't access internal servers using public IP addresses from the internal network.

I know what the problem is. I did a lot of Google searching about this problem, and I learned that most firewall/routers automatically handle this situation.

In case of Cisco, NAT hairpinning is the one of the solutions (I don't know if I am correct). How can i do that?.

enter image description here

i need to access the server using the IP address 202.192.68.235 from my PC, but I can't.

8
  • Can you post a diagram and configuration of your router? There's not enough information to help you. – Ron Trunk Dec 22 '15 at 11:54
  • edited my question. hope this will help u – sareeshmnair Dec 22 '15 at 12:06
  • 1
    Unfortunately, you can't make the router do what you want. You can't use the outside address to get to the server in the configuration you have. – Ron Trunk Dec 22 '15 at 15:58
  • Do you need to actually use the IP address, or can you use the DNS name? You could modify your local DNS to return the local IP address instead of the public IP address. – Ron Maupin Dec 22 '15 at 16:37
  • 1
    Cisco "doesn't do that". There are some involved hacks to make it work, but you really don't want to go there. Basically, NAT applies to packets received on an interface; as internal traffic never passes through the "outside" interface, they never get translated. Under IOS, loopback interfaces and policy-routing can make it happen, but it's a config mess and processing nightmare. – Ricky Dec 22 '15 at 21:45
3
+50

NVI NAT's already been brought up by Aaron D.

Here's a the relevant config bits of a working example. It's been done on a CISCO881 with IOS 15.4(3)M6a

Outside network: 172.19.31.0 /24   on  FastEthernet4
Inside network:  172.19.140.0 /23  on VLAN141/SVI141
exposed host:    172.19.141.24
external port:   2222
internal port:   22

Interface configuration:

interface FastEthernet4
 ip address 172.19.31.2 255.255.255.0
 ip nat enable

interface Vlan141
 ip address 172.19.140.1 255.255.254.0
 !
 ! hairpinning did not work until ip redirects were disabled
 !
 no ip redirects
 ip nat enable

NAT ACL:

ip access-list standard ACLv4_SUBNET141
 permit 172.19.140.0 0.0.1.255

NAT rules:

ip nat source static tcp 172.19.141.24 22 interface FastEthernet4 2222
ip nat source list ACLv4_SUBNET141 interface FastEthernet4 overload

In a nutshell:

  1. set the relevant interfaces to "ip nat enable" instead of "ip nat in/outside", and slightly modify the NAT rules.
  2. make sure that there is an NVI NAT style outbound policy, or the hairpinnable host won't be able to connect outbound or hairpin to itself.
  3. disable ip redirects on the "inside" interface, or hairpinning (at least not from the host itself) will not work.

Caution: NVI NAT can be VERY taxing on the CPU of low-end routers like the 800 series. Where my old 881 used to be able to deliver 50-60Mbit/s with classic NAT, switching over to NVI caused the throughput to drop to 20-30Mbit/s and would have the CPU glowing red when under load.

That was also the case when the to-be-hairpinned translation was not actually in use, just with traffic matching the normal "interface ... overload" outbound NAT rule.

0

On an ASA this is pretty easy. On a router, I think you can set up Nat/NVI to achieve what you want.

Try this: Cisco Router Easy Hairpin NAT

0

This is a case of port forwarding to the same network. For such DMZ's setups, hairpinning is preferred or having local DNS to resolve for such internal servers. Apart from them there is an equivalent solution for it.

The solution is to have DNAT rule for your LAN zone also so that the packet with destination ip 202.192.68.235 from local client can be translated to 10.0.6.35 and routed back to the same network by the router.

But again the problem is that the server will try to reply directly to the client since it belongs to the same network. Now to make the server reply the client via router we need to add an SNAT rule that would make the source as router.

Your SNAT rule should be very specific such that it applies only for traffic coming from local subnet and destined for 10.0.6.35. This will solve your problem for sure.

To summarize you have to add a DNAT and an SNAT rule for LAN interface.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.