1

I am trying to configure port forwarding on a Cisco 891F router given by an ISP and directly connected to servers in the 192.168.170.0/24 network. The ISP recommended using the ip nat inside source static tcp 192.168.170.108 8080 1.2.3.4 8080 extendable but this along with other rules to the other servers are not functioning.
Internet has been configured using a standard access-list and changing the config may log everyone connected remotely out.
What ip nat commands can I use to achieve Port Forwarding to the servers via the public IP?
Part of the Router Config

ip nat inside source list 1 interface GigabitEthernet8 overload
ip nat inside source static tcp 192.168.170.108 8080 1.2.3.4 8080 extendable
ip nat inside source static tcp 192.168.170.100 9000 1.2.3.4 9000 extendable
ip route 0.0.0.0 0.0.0.0 1.2.3.1
!
!
access-list 1 permit 192.168.170.0 0.0.0.255
`
  • 1
    What are the other servers, and in what way exactly is it not functioning? The full config would be helpful, particularly if there are other NAT rules as your mention of 'other servers' suggests. I just implemented a very similar configuration. – boomi Aug 25 '18 at 1:45
  • There are Ubuntu servers connected in that range...the Gi0/8 is the internet port with up nat outside – Manny265 Aug 25 '18 at 5:02
  • Time outs is what I mean – Manny265 Aug 25 '18 at 5:03
1

If Gig8 gets it's IP address dynamically (DHCP, PPPoE), you'll have to do this (in short: replace 1.2.3.4 with the interface name).

ip nat inside source static tcp 192.168.170.108 8080 gigabitEthernet8 8080 
ip nat inside source static tcp 192.168.170.100 9000 gigabitEthernet8 9000 

Having 1.2.3.4 at this place in the NAT statement would only work if ...

  • either gig8 has this address configured (static adressing)
  • or if the next-hop upstream router has a route for 1.2.3.4 that points to the actual address of Gig8.

If your are running CBAC (context based access control with ip inspect...) or ZBFW (zone based firewall), or if you have an inbound ACL on the outer interface for some other reason, there will be an access-list to/for the external Interface that will have to include something like this:

 ...
 permit tcp any host 192.168.170.108 eq 8080
 permit tcp any host 192.168.170.100 eq 9000
 ...

In the case of CBAC or the general purpose access list, these lines need to be part of the inbound access-list that sits on the external interface.

In the case of ZBFW, the ACL should be used by a class-map type inspect match-any <classmapname> which is used in turn by a policy-map type inspect <policymapname> which is in turn used as service-policy type inspect of the given zone-pair security ...

  • the 1.2.3.4 was a placeholder for our public IP address, after re-inserting the rules with gigabit interface, the port forwarding rules worked. – Manny265 Aug 28 '18 at 6:04

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.