I am trying to configure port forwarding on a Cisco 891F router given by an ISP and directly connected to servers in the network. The ISP recommended using the ip nat inside source static tcp 8080 8080 extendable but this along with other rules to the other servers are not functioning.
Internet has been configured using a standard access-list and changing the config may log everyone connected remotely out.
What ip nat commands can I use to achieve Port Forwarding to the servers via the public IP?
Part of the Router Config

ip nat inside source list 1 interface GigabitEthernet8 overload
ip nat inside source static tcp 8080 8080 extendable
ip nat inside source static tcp 9000 9000 extendable
ip route
access-list 1 permit
  • 1
    What are the other servers, and in what way exactly is it not functioning? The full config would be helpful, particularly if there are other NAT rules as your mention of 'other servers' suggests. I just implemented a very similar configuration.
    – boomi
    Aug 25, 2018 at 1:45
  • There are Ubuntu servers connected in that range...the Gi0/8 is the internet port with up nat outside
    – Manny265
    Aug 25, 2018 at 5:02
  • Time outs is what I mean
    – Manny265
    Aug 25, 2018 at 5:03

2 Answers 2


If Gig8 gets it's IP address dynamically (DHCP, PPPoE), you'll have to do this (in short: replace with the interface name).

ip nat inside source static tcp 8080 gigabitEthernet8 8080 
ip nat inside source static tcp 9000 gigabitEthernet8 9000 

Having at this place in the NAT statement would only work if ...

  • either gig8 has this address configured (static adressing)
  • or if the next-hop upstream router has a route for that points to the actual address of Gig8.

If your are running CBAC (context based access control with ip inspect...) or ZBFW (zone based firewall), or if you have an inbound ACL on the outer interface for some other reason, there will be an access-list to/for the external Interface that will have to include something like this:

 permit tcp any host eq 8080
 permit tcp any host eq 9000

In the case of CBAC or the general purpose access list, these lines need to be part of the inbound access-list that sits on the external interface.

In the case of ZBFW, the ACL should be used by a class-map type inspect match-any <classmapname> which is used in turn by a policy-map type inspect <policymapname> which is in turn used as service-policy type inspect of the given zone-pair security ...

  • the was a placeholder for our public IP address, after re-inserting the rules with gigabit interface, the port forwarding rules worked.
    – Manny265
    Aug 28, 2018 at 6:04

Static NAT is used to translate a single private IP address with a single public IP address. When application is hosted in the internal network wants to access application from internet static NATting is used. It's one to one NATting ...

Configuration part as below

Firstly servers should assigned static ip and make sure servers are reachable from router where this static natting is done

Server1 = Server2= Server3=

Configuration as below for example

Router#(config)# int f0/1 #ip nat inside #no shutdown

Fo/1 = interface is connected to inside network

Router#(config)#int f0/0 #ip nat outside #no shutdown

F0/0= interfàce connected to outside interface for example ISP

Request ISP for 3 static public ips to take forward this requirement

For example ISP has allocated 3 public ip as




Static nat configuration

Router(config)# ip nat inside source static

Router(config)#ip nat inside source static 210.67.89 12

Router(config)#ip nat inside source static

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.