2

I'm trying to get traffic forwarded from my network's public IP to a private IP within the network to allow access to a server from outside the LAN. I can't quite figure out how to do it unfortunately. The private IP I want to connect to is 172.29.1.130, and the public internet-facing IP is, say, 5.6.7.8. The port I want to forward is 25565, and my config is here:

!
!
controller VDSL 0
 shutdown
!
!
!
!
!
!
!
!
!
!
!
!
!
interface ATM0
 no ip address
 shutdown
 no atm ilmi-keepalive
!
interface Ethernet0
 no ip address
 shutdown
!
interface FastEthernet0
 no ip address
!
interface FastEthernet1
 no ip address
!
interface FastEthernet2
 no ip address
!
interface FastEthernet3
 no ip address
!
interface GigabitEthernet0
 switchport access vlan 101
 no ip address
!
interface GigabitEthernet1
 ip address dhcp
 no ip redirects
 no ip unreachables
 no ip proxy-arp
 ip flow ingress
 ip nat outside
 ip virtual-reassembly in
 duplex auto
 speed auto
!
interface Vlan1
 description $ETH_LAN$
 ip address 10.10.10.1 255.255.255.248
 ip tcp adjust-mss 1452
!
interface Vlan101
 ip address 172.29.0.253 255.255.0.0
 no ip redirects
 no ip unreachables
 no ip proxy-arp
 ip flow ingress
 ip nat inside
 ip virtual-reassembly in
!
ip forward-protocol nd
ip http server
ip http access-class 23
ip http authentication local
ip http secure-server
ip http timeout-policy idle 60 life 86400 requests 10000
!
!
ip nat inside source list 1 interface GigabitEthernet1 overload
ip route 0.0.0.0 0.0.0.0 dhcp
!
access-list 1 permit 172.29.0.0 0.0.255.255
access-list 23 permit 10.10.10.0 0.0.0.7
access-list 23 permit 172.29.0.0 0.0.255.255
mac-address-table aging-time 15
no cdp run
!
banner exec ^C
% Password expiration warning.
-----------------------------------------------------------------------

Cisco Configuration Professional (Cisco CP) is installed on this device
and it provides the default username "cisco" for  one-time use. If you have
already used the username "cisco" to login to the router and your IOS image
supports the "one-time" user option, then this username has already expired.
You will not be able to login to the router with this username after you exit
this session.

It is strongly suggested that you create a new username with a privilege level
of 15 using the following command.

username <myuser> privilege 15 secret 0 <mypassword>

Replace <myuser> and <mypassword> with the username and password you
want to use.

-----------------------------------------------------------------------
^C
banner login ^C
-----------------------------------------------------------------------
Cisco Configuration Professional (Cisco CP) is installed on this device.
This feature requires the one-time use of the username "cisco" with the
password "cisco". These default credentials have a privilege level of 15.

YOU MUST USE CISCO CP or the CISCO IOS CLI TO CHANGE THESE
PUBLICLY-KNOWN CREDENTIALS

Here are the Cisco IOS commands.

username <myuser>  privilege 15 secret 0 <mypassword>
no username cisco

Replace <myuser> and <mypassword> with the username and password you want
to use.

IF YOU DO NOT CHANGE THE PUBLICLY-KNOWN CREDENTIALS, YOU WILL
NOT BE ABLE TO LOG INTO THE DEVICE AGAIN AFTER YOU HAVE LOGGED OFF.

For more information about Cisco CP please follow the instructions in the
QUICK START GUIDE for your router or go to http://www.cisco.com/go/ciscocp
-----------------------------------------------------------------------
^C
!
line con 0
 login local
 no modem enable
line aux 0
line vty 0 4
 access-class 23 in
 privilege level 15
 login local
 transport input telnet ssh
!
scheduler allocate 60000 1000
!
end

What do I need to do to get it to work?

4

You need an additional NAT (Port-Forwarding) rule for it:

  1. If you want to do this on your outside interface GigabitEthernet1

    ip nat inside source static tcp 172.29.1.130 25565 interface GigabitEthernet1 25565
    
  2. If you want to do this on public internet-facing IP (belong to your assigned public IP block) - 5.6.7.8:

    ip nat inside source static tcp 172.29.1.130 25565 5.6.7.8 25565
    

Ensure that the ACL in your network allows this traffic from public/Internet.

I hope it is helpful.

| improve this answer | |
  • How would I then configure the ACL to allow it through? – happyfrog99 Dec 7 '17 at 23:09
  • @happyfrog99 You do not need ACL on this Router. I mean, in general, if you have Firewall in your internal/inside network, ensure your Firewall allow this traffic. – Hung Tran Dec 7 '17 at 23:22
  • @happyfrog99 Have you tested the NAT rules I put above? – Hung Tran Dec 7 '17 at 23:23
  • I have tried both of them and they were unsuccessful @HungTran. The network doesn't have a firewall, so I doubt it is that either. Some access control rules are listed in the config, so I think there might be something there – happyfrog99 Dec 8 '17 at 0:11
  • @happyfrog99 How did you test? You have to ensure that port 25565 is listening/running on 172.29.1.130. Turn on packet-capture (e.g Wireshark) on 172.29.1.130 to see if this kind of traffic hit it or not. Last but not least, schedule a time when there is low/no public traffic in your network (after work hours), turn on debug ip nat, test and see if this new NAT rule works or not. – Hung Tran Dec 8 '17 at 12:19

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.