Simple PAT problem

crmljc1976 · ‎07-24-2008

Im using a Cisco 877 and I have one global IP address, and inside local network on 192.168.0.0. I have one machine 192.168.0.5 which is a VNC server, RDP server, and video recorder which uses a range of ports. I would like to forward all these ports to that one server and was wondering how to configure it. I also have a 10.0.5.0 subnet on the network, which needs access to the internet via the cisco 877.

Can anyone give me some advice on the best way to set it up?

Collin Clark · ‎07-24-2008

First setup a NAT translation from the outside to the inside server.

ip nat inside source static tcp 192.168.0.5 3389 interface Dialer0 3389

ip nat inside source static tcp 192.168.0.5 5900 interface Dialer0 5900

Do the same for the ports for your video recorder. Add the ports to your outside ACL.

For adding the 10.0.5.0 network, just add the network to your ACL or NAT statement (depends on how it is currently configured). If you're using a different interface, don't forget to add ip nat inside under the interface.

Hope that helps.

crmljc1976 · ‎07-24-2008

would my outside acl look something like this?

access-list 102 permit tcp any host wanip eq 3389.

Do I need to apply that to the interface too using access-group 102 in?

Collin Clark · ‎07-24-2008

Yup, you got it!

crmljc1976 · ‎07-24-2008

when I do this all outbound from 10.0.5.0 and 192.168.0.0 is blocked. How do I resolve this?

Collin Clark · ‎07-24-2008

Blocked? What are you seeing in the logs?

crmljc1976 · ‎07-24-2008

I must have my access lists wrong,

I have been entering access-list 101 permit tcp any host 192.168.0.5 eq 3389 which is the internal host instead of...

access-list 101 permit tcp any host dialer0 IP eq 3389

Collin Clark · ‎07-24-2008

It should be the public IP address or if you get the IP dynamically, you'll have to use the any keyword again.

crmljc1976 · ‎07-25-2008

This is my config . Can you have a look and tell me if it will work