Cisco Support Community
Showing results for 
Search instead for 
Did you mean: 

Welcome to Cisco Support Community. We would love to have your feedback.

For an introduction to the new site, click here. If you'd prefer to explore, try our test area to get started. And see here for current known issues.

New Member

Destination Nat

Got a question here that I hope somebody can answer for me. I have the following scenario:

I have 3 dns servers. 2 are live and have valid addresses, one is old and is being taken offline. Because of some hassles with Netsol I cannot take the old server off the listed dns servers for roughly 200 domains. Because of this I need to forward all traffic destined for udp port 53 on the old servers ip address to one of the other servers. Now under linux this was simple:

iptables -t nat -A POSTROUTING -p udp -d --dport 53 -j DNAT --to

However, we have just replaced our linux router with a cisco 2600 series and no matter what I or anyone else tries it just doesn't work. This is what we have tried thus far:

ip nat inside source static udp 53 53 extend

on int fast 0/0

ip nat outside

on int fast 0/1

ip nat inside

now what happens is that all traffic for on port 53 is indeed mapped to, but traffic for on it's own is lost. I then gave our nameserver another ip address of and did the same ip nat command to that ip. This, however, does not work at all on either machine. If I do a no ip nat inside/outside on the if's I CAN pull queries directly from

Does anyone have the foggiest clue on how to do what I am trying to do?


Ed McLain

Net Admin


New Member

Re: Destination Nat

I have typically used address translation to translate from an outside global address to a private internal address, but I believe this may work:

ip nat outside source static

- Available beginning with IOS v.11.2

As I said, I have never used this command to translate from one global address to another. But, if this works you can use an access list to filter traffic for a specific port. I don't know if there is a way to translate an address only for a specific tcp port, but you can do port translation.

Then you can apply an inbound access list on the outside interface to allow only port 53 for that specific host:

access-list 101 deny tcp any host neq 53

access-list 101 permit ip any any

- Make sure these commands are in this order

Or, if you prefer, use no access list at all and allow all IP traffic to pass.

Hope this helps,