Port forwarding using NAT ?

smvoicerite · ‎03-12-2008

Hi,

I have a range of ip address, and have all my LANs nat'ed to a single IP address.

All this works fine.

Now I want to add a static entry, to port forward SMTP arriving on my public IP address to an internal server.

(The outgoing traffic from the internal server normally gets nat'ed as with the rest of the lan to x.x.x.114)

I add an entry like

ip nat inside source static tcp x.x.x.118 25 192.168.1.9 25

I see the static translation in the sh ip nat translations.

However, when I try and telnet to port 25 of the public IP address x.x.x.118, I get a connection refused.

I have disabled ACLs for that address range, and have tested telneting from the router to the target server, specifying the external IP address as the source and it works.

I also have another server, which is completely staticly nat'ed to an external IP address, (with no tcp/udp ports) and that works fine.

However, I dont want to staticly nat 192.168.1.9 for all ports. Just for SMTP.

Any ideas what I may be doing wrong ?

Thanks

maxmarschall · ‎03-12-2008

You should configure "ip nat inside" and "ip nat outside" on your interfaces. But I think you're finished with this step, aren't you?

smvoicerite · ‎03-12-2008

Actually I later realised that the remote system I was testing from, had some firewall that I was not aware of.

After testing over the internet from another PC, it worked fine !

Thanks

james.leavers · ‎05-20-2008

Assuming x.x.x.118 is your global address - don't you have the addresses the wrong way round?

(config)#ip nat inside source static tcp ?

A.B.C.D Inside local IP address

(config)#ip nat inside source static tcp 1.1.1.1 25 ?

A.B.C.D Inside global IP address

interface Specify interface for global address

shahedvoicerite · ‎05-20-2008

yes, you are right. It was a typo on my part in the post.

I did get it to work fine later :-)

Thanks

jamesl0112 · ‎05-21-2008

I came across the post while searching for something else, and didn't notice there had already been some replies... ah well.

Congratulations on the fix anyway!