Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
Community Member

port forwarding a udp range in IOS 15

Hi,

How can I configure NAT to port formward a range of udp ports to an internal IP address in IOS?  In otherwords, I would like to forward UDP range 10000-20000 from my external IP to a particular internal IP address.  I have one public IP address and am overloading other internal hosts per typical PAT.

I have tried the following two approaches with out success:

Approach 1: NAT inside destination

ip nat inside destination list 100 pool POOL

ip nat pool POOL 192.168.1.10 192.168.1.10 netmask 255.255.255.0 type rotary

access-list 100 permit udp any any range 10000 2000

ip nat inside source list 101 interface FastEthernet0/1 overload

access-list 101 permit ip 192.168.1.0 0.0.0.255 any

This approach is apparently only valide for TCP.  When configured for UDP, as above, the translation does not get installed in the translation table.

Approach 2:  Route Maps

ip nat inside source static 192.168.1.10 X.X.X.X route-map RTP extendable

route-map RTP permit 10

match ip address 100

access-list 100 permit udp host 192.168.1.10 any range 10000 20000

ip nat inside source list 101 interface FastEthernet0/1 overload

access-list 101 permit ip 192.168.1.0 0.0.0.255 any

This approach forwards any UDP traffic to host 192.168.1.10.  For example, a UDP packet arriving at my public interface with destination port UDP/30000 is still forwarded to host 192.168.1.10 and the translation is installed in the NAT translation table.  This is not desired.

Is there an approach to port forwarding a range of UDP ports in IOS 15 that will forward the desired range only to a specific inside host?

Thanks!

1 REPLY
Bronze

Re: port forwarding a udp range in IOS 15

Try this:

http://www.cisco.com/en/US/docs/ios/12_2t/12_2t4/feature/guide/ftnatrt.html

Just change the example 101 and 102 ACL's to include the specific port range you want to forward and use the route-map to define the next-hop address per your NAT statement.

Although, since you're already doing an overload on the same IP, it may not play nice.  Any chance for another IP address in the same range?

2742
Views
0
Helpful
1
Replies
CreatePlease to create content