We are running a few services in our internal network that we would like to expose to the outside world. At first we were having trouble with email, dns, and www. Not sure what happened but email and dns started working all of a sudden.

In regards to www, we are forwarding the traffic to our apache server (, with the following port forward rule:

ip nat inside source static tcp 80 interface Dialer0 80

For some reason it's getting routed to another server on the network. We know this due to the firewall of that server burning the request. Is there any way to make these static rules more enforced, and getting the traffic to the right server.


tcp <public>:53        ---                   ---
tcp <public>:25       ---                   ---
tcp <public>:465      ---                   ---
tcp <public>:993      ---                   ---
--- <public>       ---                   ---

NAT Definitions

no ip nat service sip udp port 5060
no ip nat service sip udp port 5080         
ip route Dialer0
access-list 1 permit
ip nat inside source list 1 interface Dialer0 overload
ip nat inside source static tcp 53 interface Dialer0 53
ip nat inside source static tcp 80 interface Dialer0 80
ip nat inside source static tcp 25 interface Dialer0 25
ip nat inside source static tcp 465 interface Dialer0 465
ip nat inside source static tcp 993 interface Dialer0 993
ip nat inside source static tcp 995 interface Dialer0 995
ip nat inside source static tcp 443 interface Dialer0 443
ip nat inside source static udp 5060 interface Dialer0 5060
ip nat inside source static udp 5080 interface Dialer0 5080
access-list 130 permit udp any any range 8000 65535
route-map voip-rtp permit 1
match ip address 130
ip nat inside source static <public ip> route-map voip-rtp

NAT Trans

tcp public-ip:53        ---                   ---
tcp public-ip:25       ---                   ---
tcp public-ip:465      ---                   ---
tcp public-ip:993      ---                   ---
--- public-ip           ---                   ---

Thanks in Advance,

Nick from Toronto.

  • are your providing the full output of "sh ip translations" ?
    – aseaudi
    Jan 6, 2014 at 23:22
  • After the trans clear, yes. Before the trans clear there is all the sip and rtp routing
    – Nick Cameo
    Jan 7, 2014 at 14:42
  • have you got all this sorted out? BTW, if a previously selected answer isnt right, go ahead and unselect. We want you to get thr right answer to your problems Jan 8, 2014 at 12:38
  • Hello Mike, thank you for your time. I don't think the two topics are related even though they are very similar. At first we wanted to find a way to forward a range of UDP ports using a route map. Now, we would like to drop the route map for RTP, and still maintain the port forwarding of the SIP traffic. After a few days of disruptions to our clients, we wanted to let things settle before dropping all nat rules and reinserting them one by one. Sorry for the extended... :) VoIP, email, DNS is up, WWW is down...
    – Nick Cameo
    Jan 8, 2014 at 19:29

1 Answer 1


Is there somehow a second port 80 rule? (shouldn't be possible, but I've seen it happen)

show ip nat translations | include ---

Is the arp cache on the router somehow wrong -- i.e. it thinks 2.15 is at a different machine?

show ip arp <inside interface>

And lastly, IOS has, in the past, had significant issues with NAT and dynamic interface addresses. On my cablemodem-feed router, I have to replace the NAT rules with full IP addresses (every time the address changes!) to make it work; the rules won't apply correctly if dhcp is setting the address, or if the address later changes with the interface up. I've never used "interface nat" on the DSL line with a static address.


ip nat inside source static <public ip> route-map voip-rtp

That is what's causing the error. As you can see in the firewall output, the DST is 2.5, not 2.15. And there's no port 80 translation in the table.

[Further Update]

There is no way to make a Cisco IOS device NAT a UDP port range. It'll work perfectly for TCP, but completely ignores UDP. (nice of Cisco to do that.) If you attempt to use route-maps with an acl that specifies ports, it generates an error matching the acl. (turn on various debug's to see it) Inside destination NAT ignores the UDP part.

  • Hello Ricky, you effort is much appreciated. At first all the services got off on a sluggish start however, I think it's stabilized (but not trustworthy). I have added the result for ip trans, and arp mac addresses all line up (just in case I cleared the linux servers). We have no dhcp on our netowrk. All computers are have static address that have never changed.
    – Nick Cameo
    Jan 6, 2014 at 21:03
  • I forgot to mention port 80 is still getting routed to the wrong address. The firewall burn of .15: Jan 6 16:14:56 toronto kernel: [2424311.366025] TCP LOGINPUTDROP:: IN=eth1 SRC= DST= LEN=60 TOS=0x00 PREC=0x00 TTL=46 ID=43752 PROTO=TCP SPT=59806 DPT=80 WINDOW=62920 RES=0x00 SYN URGP=0 OPT (020405960402080A36B71B8C0000000001030306). I do have a route map that ranges 8000-65535 shown above on udp. Could this be the problem?
    – Nick Cameo
    Jan 6, 2014 at 21:21
  • Are you using the same nat command syntax for the rest of translations shown in the table (53, 25, 465, ..)?
    – aseaudi
    Jan 6, 2014 at 21:43
  • Hello Aseaudi, I posted all the NAT related directives in my original post. Should have done that from the beginning.
    – Nick Cameo
    Jan 6, 2014 at 21:54
  • 3
    see my update. your rtp setup is messing things up.
    – Ricky
    Jan 6, 2014 at 22:08

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.