I have a couple of rather basic questions about NAT translation.

For a simple translation like:

ip nat inside source list ACL interface GigabitEthernet 0 overload

If the traffic does not match ACL, it will go out untranslated. So why not just make ACL permit ip any any?

In the case which the outside interface is the WAN, it would waste bandwidth if this traffic went out, either translated or un-translated. So, is there a way to block traffic not translated by NAT from going out? I have tried applying an output ACL on the interface but it ended up blocking even NAT translated traffic.

  • Did any answer help you? If so, you should accept it so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you could provide and accept your own answer. – Ron Maupin Feb 21 '18 at 14:25

Suppose you are a business with several blocks of public address space. You want to conserve that address space for your public-facing servers, but your employees get private addressing for their PCs. In this case, you want to NAT the PCs, but not any of the public addressing.

You seem to be thinking like a residential ISP customer, but the Cisco routers are really aimed at businesses, which often have blocks of public addressing. NAT is a kludge to be used only when you must. There is no reason to NAT everything that passes through an interface, and it is often desirable not to.

As far as blocking certain traffic from going out an interface, you are going to need to be much more detailed about what you mean, what you have tried, and why you think it didn't work.


No ! Generally access -list is configured in such way that outbound traffic initiated from LAN subnets only

Assuming LAN subnet ip pool is

Then access list would be

Router(config)#access-list 100 permit any

Router(config)#ip nat inside source list 100 interfàce gigabit Ethernet 0/0 overload

So there will be no untranslated outbound traffic because traffic will only initiate from LAN subnet so this traffic matches access-list and this translates private ip address to public ip address .

  • The issue is that untranslated traffic will still go out, untranslated. In reality, there are usually more than two subnets on a router. I could enable VRF and Unicast RPF to limit the route and source. But this makes the config over complicated. – some user Jan 23 at 17:38
  • If your are having two subnet then make sure create two access-list . Don't leave any traffic going outside interface untranslated – Sagar Uragonda Jan 24 at 8:00

Correct answer on your question would be two ACL's: one is for actual NAT, and another - outgoing ACL from your WAN interface.

ip access-list extended ACL-NAT
 deny ip any
 deny ip any
 deny ip any

ip access-list extended ACL-WAN-OUT
 deny ip any
 deny ip any
 deny ip any
 permit ip any any

ip nat inside source list ACL-NAT interface GigabitEthernet 0 overload
interface GigabitEthernet0
 ip access-group ACL-WAN-OUT out
  • I think you meant to say "permit ip ..." in your ACL-NAT. – some user Nov 26 '17 at 3:50
  • @someuser no, I don’t – Andrey Prokhorov Nov 26 '17 at 22:35
  • @someuser ok, let me explain. ACL-NAT it's your ACL that decides who will be NATted and who will be not. And in first three rules we're denying translation to RFC 1918 networks (local addresses). Then you can replace my <HERE YOUR DETAILED RULES...> line and insert something like permit tcp any any eq 80 443, that will allow HTTP/HTTPS from your any local IP to any external IP. And after ACL-WAN-Out comes in. Here we're denying any LOCAL IP to get out untranslated from your WAN interface, which is GigabitEthernet 0. – Andrey Prokhorov Apr 23 '18 at 7:25

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.