I'm using NAT Hairpin on a 1841 cisco router, I would like to open a range of ports 5555 - 5574 tcp and 2326 - 2485. All I've been able to find is command for using NAT (inside) / (outside). Anyone have any suggestions when you NAT Hairpin feature?


  • Did any answer help you? If so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you could provide and accept your own answer.
    – Ron Maupin
    Aug 15, 2017 at 3:40

1 Answer 1


You need to use ACLs which would stop all traffic that isn't defined in the ACL rules. If you have only nat(inside,outside) that will allow all traffic out and and block all traffic in. There are some specially crafted packets that might get around this but most likely to be done by an ISP.

Take a look at this doc http://www.cisco.com/c/en/us/support/docs/security/ios-firewall/23602-confaccesslists.html

You need something like this:

permit tcp any range 5555 5574

I don't have a router to experiment on right now but will try to pull a config segment if you can't get it going.

Here is another resource similar to your question. https://supportforums.cisco.com/discussion/11593786/nat-udp-port-range-forwarding-howto

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.