Accessing local machines behind a NAT using public addresses

[msmbarab]

Hello,

I have configured my Cisco 2610 XM with both static and dynamic NAT. The servers on the internal network can be accessed from outside using addresses and ports specified in static nat entries. A problem comes out when I need to access an internal machine using its public ip address (outside local) from another internal machine. In this case the connection is not set up. If I try to connect to the same machine (same public ip address/port) from outside the connection is estabilished.

I need to access local machines using public addresses because those ips are returned by my DNS server.

Do I have to configure an internal-network DNS server that resolves names to private ip addresses or is there a way to configure NAT to allow packets to "go out and then come in again"?.

Thanks in advance

[thisisshanky]

Does the machine on the inside, with the public address, having a local private address ?

If thats the case, you can remap the public IP resolved in the DNS reply, to that private address, so that when the clients get the dns reply, they will see only the private IP and not the public IP. Hence those clients would directly communicate with the machine (which you want to access using public IP).

THis is how it works.

Clients on the 10.x.x.x network send a DNS request. DNS request goes to DNS server outside the NAT domain. Due to ip nat inside command on the router, source address does get translated.

Now on the DNS reply, the payload of the DNS reply has the public IP of the host you want to access. We need to translate it to a local 10.x.x.x address, so that your clients can access the host directly, without the router intervention.

Use a ip nat outside source, command, which will make the router, change the payload of the DNS reply. So once you do this, the clients will see the DNS name of the host resolved into a private 10.x.x.x address, rather than the public IP.

Hope this helps!

[msmbarab]

Thank you very much for your reply

Yes, the machine on the inside has got an internal address and I need to access it from the internal network but using its public ip address.

I have tried the ip nat outside source static but the command takes only an outside global and an outside local ip address as parameters. If I have understood what you meant, don' t I need to translate an outside local address to an inside local one? How can I do that with this command?

Thank you once again

[thisisshanky]

What you should be doing is, simply add a static outside to inside mapping as follows

ip nat outside source static

where global ip is public IP of host, and local ip is the private ip of host. (host is the PC which you want to access.

Mode of access to this host from clients should be using DNS and not public IP. Hope this helps!

This should work.

[msmbarab]

Hi,

I have tried to insert that line in the NAT configuration but it still doesn' t work. With that line even connections from the outside don' t work.

What should I try?

Thanks