The router gets an External IP address via DHCP from the Cable modem Clients inside the network get an IP address from Router's DHCP server I can ping that the external IP address from a client inside my network I cannot ping Did a traceroute and ping dies at router's internal IP (GigabitEthernet0/1)

I think the issue might be at the NAT configuration, any ideas are very welcome!

This is my config:

ip dhcp excluded-address

ip dhcp pool 10

interface GigabitEthernet0/0
 ip address dhcp
 ip nat outside
 duplex auto
 speed auto
interface GigabitEthernet0/1
 ip address
 ip nat inside
 duplex auto
 speed auto

ip classless
ip route GigabitEthernet0/0

ip nat inside source list LAN interface GigabitEthernet0/0 overload
ip route GigabitEthernet0/0
ip access-list standard LAN
ip access-list extended WAN
 permit tcp any any established
 permit ip any any
  • Hello, Dario, and welcome to Network Engineering! I would consider removing default route and adding to your GigabitEthernet 0/0 line ip dhcp client request router that will request default route from your ISP. Dec 20, 2018 at 15:26
  • Thank you for the suggestion Andrey, I will try that tonight
    – Dario
    Dec 20, 2018 at 15:43
  • I looked on the commend list for the interface and I cannot find "ip dhcp client request router" can you please be more specific with the command and where to add it? thank you
    – Dario
    Dec 20, 2018 at 15:55
  • It may be that it is actually working, but your DNS is not right. It is pointing to your router instead of a DNS server. In the DHCP configuration, you have dns-server Try it with a real DNS server like dns-server
    – Ron Maupin
    Dec 20, 2018 at 20:37
  • That's a good point, I had an DNS error from the client when I ran the windows troubleshooter
    – Dario
    Dec 20, 2018 at 22:46

4 Answers 4


If the router is getting DHCP from your ISP, consider changing your route to

ip route dhcp

You do have to delete the existing route

no ip route GigabitEthernet0/0

Your access-list WAN isn't doing anything: it's good practice to delete ones which you're not using. Additionally, your access-list LAN is a /16 but your address on the local side is /24 -- not necessarily an error

Once you have connectivity to, you might want to change the DNS server address handed out by your DHCP.

  • Thank you, I will update after changes are tested and completed.
    – Dario
    Dec 20, 2018 at 15:45
  • I tried to test the change on packet trace and I'm getting this error: 1921(config)#ip route dhcp ^ % Invalid input detected at '^' marker.
    – Dario
    Dec 20, 2018 at 15:58
  • I see that packet tracer is showing routers running various version of IOS; the command is working on my physical routers running Version 15.4(3)M3. What model and version of router do you have?
    – jonathanjo
    Dec 20, 2018 at 16:20
  • That's a good point! the Router is a 1921 running 15.1
    – Dario
    Dec 20, 2018 at 16:24
  • Per ricky's answer, you'll get a route from DHCP without explicitly asking for it, just tested now with packet tracer on 2811 with 12.2: interface fast0/0 ip address dhcp and no route statements at all. show ip route shows a default route as given by dhcp
    – jonathanjo
    Dec 20, 2018 at 16:41

Remove this ip route GigabitEthernet0/0. Do you know what proxy-arp is? Do you need proxy-arp? I didn't think so.

You don't need to set a default route as dhcp will automatically set it.

In 99% of all "can't get to the internet" problems it is later revealed ip routing wasn't enabled. (or more accurately, someone explicitly turned it off, as it's on by default) Is there, perhaps, a no ip routing line in your config?

  • I checked in my notes and is not but, I will verify that in the main config at the Router later, thank you
    – Dario
    Dec 20, 2018 at 16:32
  • Update: if you have "backup" default routes (higher metric), the dhcp route will have to be explicitly included. Wasn't necessary prior to IOS 15.
    – Ricky
    Dec 21, 2018 at 22:28
  • The last step for making all this work was simply to restart the Modem.
    – Dario
    Mar 11, 2022 at 15:40

Finally worked out for me after I changed the ACL from:



Permit any


Yes some changes definitely required on Default routing and access -list configuration .

Default routing

IP route 0.0 .0.0 ethernet 0/0

Access -list

#access-list standard LAN permit IP Any

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.