0

my CISCO 3925 router is handling pppoe, NAT, and DHCP server..

My local LAN is 192.168.1.x and it's behind that NAT.

I'm trying to enable access to a DNS server that's on this LAN (192.168.1.191 tcp/udp 53) from the outside.

Here is what I have, access from WAN to that DNS server is not currently possible.. Any ideas why?

version 15.4
service timestamps debug datetime msec
service timestamps log datetime msec
no service password-encryption
!
boot-start-marker
boot-end-marker
enable secret  XXXX
enable password XXXX
!
no aaa new-model
ip dhcp excluded-address 192.168.1.1 192.168.1.50
ip dhcp excluded-address 192.168.1.191
!
ip dhcp pool 192.168.1.0/24
network 192.168.1.0 255.255.255.0
default-router 192.168.1.1  
dns-server 192.168.1.191 176.9.1.236  
netbios-name-server 192.168.1.191  
domain-name xxxxx.net
!
ip domain name xxx.net
ip name-server 192.168.1.191
ip name-server 176.9.1.236
ip cef
no ipv6 cef
!
!
multilink bundle-name authenticated
!
!
!
cts logging verbose
license udi pid xxxx
!          
!
!
redundancy
!
!
!
!
no cdp run
!
!  
!
interface GigabitEthernet0/0
description this is towards modem!
no ip address
duplex auto
speed auto
pppoe enable group global
pppoe-client dial-pool-number 1
no cdp enable
!
interface GigabitEthernet0/1
description inside network!!
ip address 192.168.1.1 255.255.255.0
ip nat inside
ip virtual-reassembly in
duplex auto
speed auto
no cdp enable
no mop enabled
!
interface GigabitEthernet0/2
no ip address
shutdown
duplex auto
speed auto
!
interface Dialer1
ip address negotiated
ip mtu 1492
ip nat outside
ip virtual-reassembly in
encapsulation ppp
ip tcp adjust-mss 1452
dialer pool 1
ppp chap hostname xxxxxxx
ppp chap password 0 xxxxxxxx
no cdp enable
!
!
ip forward-protocol nd
!
no ip http server
no ip http secure-server
!
ip nat inside source list 1 interface Dialer1 overload
ip nat inside source static udp 192.168.1.191 53 interface Dialer1 53
ip nat inside source static tcp 192.168.1.191 53 interface Dialer1 53
ip default-network 193.162.105.108
ip route 0.0.0.0 0.0.0.0 Dialer1
ip route 192.168.1.0 255.255.255.0 GigabitEthernet0/1
!
!
!
access-list 1 permit 192.168.1.0 0.0.0.255
access-list 23 permit 192.168.1.0 0.0.0.255
!
control-plane
!
!
!
line con 0
line aux 0
line 2
no activation-character
no exec
transport preferred none
transport output lat pad telnet rlogin lapb-ta mop udptn v120 ssh
stopbits 1
line vty 0 4
access-class 23 in
password zzzzz
login
transport input ssh
!
scheduler allocate 20000 1000
!
end
Improve this question
1
  • I have not worked with IOS NAT in years but maybe the cause is access list 1 superscedes the static port address translation for port 53 you have for the DNS server. Check the NAT table entries to see if the DNS server is actually getting the port 53 translation or if the general NAT overload is taking place first. Share the output of 'show ip nat translation' May need to add 'extended' on the static NAT rules to allow related port forwarding. Your ISP may block port 53 anyway. You do not need a static route for 192.168.1.0/24, it is already connected on the interface.
    – FrameHowitzer
    Commented May 20, 2023 at 18:34

1 Answer 1

Reset to default
1

Solved - this works:

ip nat inside source list 1 interface Dialer1 overload
ip nat inside source list nat-list interface Dialer1 overload
ip nat inside source static tcp 192.168.1.191 53 193.162.105.108 53 extendable
ip nat inside source static udp 192.168.1.191 53 193.162.105.108 53 extendable
Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.