Static NAT for FTP access

[farhan_p2000]

NAT overload has been done successfully as follows:

1. ip nat inside and ip nat outside configured on the appropriate interfaces i.e.fa0/0 and fa0/1

2. default route added on the router.

3.additional configuration is added:

ip nat inside source list 1 interface fa0/1 overload

access-list 1 permit 192.168.1.0 0.0.0.255

Now I am trying to use static NAT for FTP:

ip nat inside source static tcp 192.168.1.X 21 x.x.x.x 21 extendable

But this does not work please help. I am trying to access FTP server from LAN by entering public address in the browser. Can access the FTP server with private address but this defeats the purpose of FTP. Please help.

[nethelper]

Hello,

can you post the full configuration of your router ? From where (that is, which IP address) are you trying to access the FTP server ?

Regards,

Nethelper

[farhan_p2000]

Router(config)#interface fa0/0

Router(config-if)#ip address 192.168.1.254 255.255.255.0

Router(config-if)#no shut

Router(config-if)#ip nat inside

Router(config-if)#interface fa0/1

Router(config-if)#ip address 203.109.120.2 255.255.255.252

Router(config-if)#no shut

Router(config-if)#ip nat outside

Router(config)#ip route 0.0.0.0 0.0.0.0 interface fa0/1

Router(config)#ip nat inside source list 1 interface fa0/1 overlaod

Router(config)#access-list 1 permit 192.168.1.0 0.0.0.255

[nethelper · Accepted solution]

Hello,

you could only use the public IP address if you are trying to access the FTP server from the Internet. If you try to access the FTP server from within your LAN (that is, from a 192.168.1.x address), it would not get translated. From within your LAN, you cannot access the FTP server using the public address.

Does that make sense ? From which IP address are you trying to access the FTP server ?

Regards,

Nethelper

[farhan_p2000]

Firstly, thanks for your prompt reply.

Yes I was using the public IP in the browser from within my LAN. So the following static NAT configuration should work?

ip nat inside source static tcp 192.168.1.x 21 x.x.x.x 21

It means I cannot check if the FTP is working from within the LAN, right?