Accessing Servers behind NAT

[anka_ozcan]

hi;

I have a FTP server behind NAT enabled Cisco router.I want to access FTP server from outside, with configuration below, when I tried to connect FTP server, from netstat command output on FTP server I see there is a connection to FTP port but wait in LISTENNING state. What is the problem?

interface FastEthernet0/0

ip address 192.168.1.1 255.255.255.0

ip nat inside

speed auto

!

interface Serial0/0

ip address <....public ip....>

ip nat outside

no fair-queue

<...rest...>

!

interface Serial0/1

no ip address

shutdown

!

ip nat inside source static tcp 192.168.1.2 20 interface Serial0/0 20

ip nat inside source static tcp 192.168.1.2 21 interface Serial0/0 21

ip classless

ip route 0.0.0.0 0.0.0.0 Serial0/0

no ip http server

!

[pkhatri]

Hi,

The fact that you can see the FTP port in a LISTENING state simply means that the FTP server is running okay.

I presume you are FTP'ing to your router's WAN IP address, right ?

Can you do a 'debug ip nat detailed' on your router to see whether the router is performing NAT or not ?

Paresh.

[Georg Pauwen]

Hello,

you might want to try and add the keyword 'extendable' to your NAT statements:

ip nat inside source static tcp 192.168.1.2 20 interface Serial0/0 20 extendable

ip nat inside source static tcp 192.168.1.2 21 interface Serial0/0 21 extendable

Regards,

GP

[anka_ozcan]

OK. but what about if we use route-map ?

for example for configuration below:

<.....>

!

ip nat inside source route-map Dialer0 interface Dialer0 overload

ip nat inside source route-map Dialer1 interface Dialer1 overload

!

access-list 97 permit 192.168.1.0 0.0.0.255

access-list 98 permit 192.168.1.0 0.0.0.255

dialer-list 1 protocol ip permit

dialer-list 2 protocol ip permit

!

route-map Dialer0 permit 10

match ip address 97

match interface Dialer0

!

route-map Dialer1 permit 10

match ip address 98

match interface Dialer1

!

<..rest of the config...>

[balajitvk]

There is a document that describes different modes of ftp and also the problems faced by customer behind one side of nat to connect to the server.

http://www.openbsd.org/faq/pf/ftp.html

i hope this will help u!

[ekiriakos]

Use the extendable keyword as suggested by GP eralier. You can still overload on the external i/f

Rgds

E.