I'm using NAT Hairpin on a 1841 cisco router, I would like to open a range of ports 5555 - 5574 tcp and 2326 - 2485. All I've been able to find is command for using NAT (inside) / (outside). Anyone have any suggestions when you NAT Hairpin feature?


  • Did any answer help you? If so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you could provide and accept your own answer. – Ron Maupin Aug 15 '17 at 3:40

You need to use ACLs which would stop all traffic that isn't defined in the ACL rules. If you have only nat(inside,outside) that will allow all traffic out and and block all traffic in. There are some specially crafted packets that might get around this but most likely to be done by an ISP.

Take a look at this doc http://www.cisco.com/c/en/us/support/docs/security/ios-firewall/23602-confaccesslists.html

You need something like this:

permit tcp any range 5555 5574

I don't have a router to experiment on right now but will try to pull a config segment if you can't get it going.

Here is another resource similar to your question. https://supportforums.cisco.com/discussion/11593786/nat-udp-port-range-forwarding-howto

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.