Hi

I own a 2621xm which I have used for port forwarding with NAT overload. from what I can see your options are to forward a port onto the address of your NATed interface with the command:

ip nat inside source static (tcp/udp) your.inside.ip.address portnumber your.interface.ip.address externalportnumber

eg

ip nat inside source static tcp 192.168.1.43 22 194.41.66.2 8022

would allow me to reach 192.168.1.43 port 22 from outside using 8022 or whatever port you specify in the command.

alternatively you could change the interface address to one in the same network so that it is seen as a different devicewith a different ip that only has the forwarded port open.

the final way would be to forward the entire inside address to a new external ip address for example if you have a 192.168.0.0 /24 NATed to 194.41.66.0 /24 through an interface with an ip of 194.41.66.2 you could run the folowing command:

ip nat inside source static 192.168.1.43 194.41.66.43

allowing you to communicate with that host as if there was no NAT. from here you can use the access-list feature to close ports that you don't need.

Hope this helps!

Barry

thanks for your response barry but it doesn't help. I already have ports forwarded in my router with the same commands you've given but the point of this thread is to forward a range of ports, not one port.

I've also read before about forwwarding all ports to a certain ip and then using an access list to trim it down but I've never seen anyone give an example of what such an access command would look like.

Tony Edison has an example of using port range above.

ok thanks I see that but I'm still having no joy. First time I tried it my internet connection dropped out. Then I tried again and got my internet connection back but the access-list given above isn't filtering any ports. My lan is on 172.16.0.0 and ip I want to forward to is 172.16.1.43 and I tried the command:

access-list 100 permit udp host 172.16.1.43 range 5060 5061 any

ip nat inside source list 100 interface dialer0 overload

it should only allow 5060 and 5061 through but the router is allowing all ports through, it's not stopping anything.

Try adding a deny line under that then.  So that the most specific is allowed and anything else is not allowed.  Are you able to post a diagram/full config minus the private information?

access-list 100 permit udp host 172.16.1.43 range 5060 5061 any

access-list 100 deny any any

@mohammed ali, thanks for your further help on this. I tried access-list 100 deny ip any any as you said but still there was no control over the incoming ports. The router just kept on allowing all ports through. I even tried access list 100 deny ip any any all on its own but still there was no port blockage, which I found very strange. The command

ip nat inside source static 172.16.1.43  interface Dialer0

does allow all ports through but nothing seems to work in blocking unwanted ports.

btw I am using IOS c2600-ipbasek9-mz.124-15.T14.bin which is one of the latest from cisco.

Hi,

try this:

http://slaptijack.com/networking/cisco-nat-and-port-range-resolution/

Regards.

Alain

@ cadet: thanks for the link. I tried the commands there but they only work with tcp, they don't work with udp. I also tried the additional configs further down in the blog but still they only worked with tcp. Nothing worked in letting udp through.

I am using c2600-ipbasek9-mz.124-15.T14.bin. If the IOS is to blame, do you know what IOS I should be using?

Hi,

yes of course the rotary solution can only work for TCP not for UDP, I'm sorry I had not remarked that you wanted a solution for UDP.

I'll let you know if  I  find a solution for UDP.

Regards.

Alain

Don't forget to rate helpful posts.