I have a couple of rather basic questions about NAT translation.

For a simple translation like:

ip nat inside source list ACL interface GigabitEthernet 0 overload

If the traffic does not match ACL, it will go out untranslated. So why not just make ACL permit ip any any?

In the case which the outside interface is the WAN, it would waste bandwidth if this traffic went out, either translated or un-translated. So, is there a way to block traffic not translated by NAT from going out? I have tried applying an output ACL on the interface but it ended up blocking even NAT translated traffic.

  • Did any answer help you? If so, you should accept it so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you could provide and accept your own answer. – Ron Maupin Feb 21 '18 at 14:25

Suppose you are a business with several blocks of public address space. You want to conserve that address space for your public-facing servers, but your employees get private addressing for their PCs. In this case, you want to NAT the PCs, but not any of the public addressing.

You seem to be thinking like a residential ISP customer, but the Cisco routers are really aimed at businesses, which often have blocks of public addressing. NAT is a kludge to be used only when you must. There is no reason to NAT everything that passes through an interface, and it is often desirable not to.

As far as blocking certain traffic from going out an interface, you are going to need to be much more detailed about what you mean, what you have tried, and why you think it didn't work.

| improve this answer | |

Correct answer on your question would be two ACL's: one is for actual NAT, and another - outgoing ACL from your WAN interface.

ip access-list extended ACL-NAT
 deny ip any
 deny ip any
 deny ip any

ip access-list extended ACL-WAN-OUT
 deny ip any
 deny ip any
 deny ip any
 permit ip any any

ip nat inside source list ACL-NAT interface GigabitEthernet 0 overload
interface GigabitEthernet0
 ip access-group ACL-WAN-OUT out
| improve this answer | |
  • I think you meant to say "permit ip ..." in your ACL-NAT. – some user Nov 26 '17 at 3:50
  • @someuser no, I don’t – Andrey Prokhorov Nov 26 '17 at 22:35
  • @someuser ok, let me explain. ACL-NAT it's your ACL that decides who will be NATted and who will be not. And in first three rules we're denying translation to RFC 1918 networks (local addresses). Then you can replace my <HERE YOUR DETAILED RULES...> line and insert something like permit tcp any any eq 80 443, that will allow HTTP/HTTPS from your any local IP to any external IP. And after ACL-WAN-Out comes in. Here we're denying any LOCAL IP to get out untranslated from your WAN interface, which is GigabitEthernet 0. – Andrey Prokhorov Apr 23 '18 at 7:25

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.