Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I recently fubared the public interface to an SSH connection. I'm trying to set up a NAT that will forward to the eth1 interface with a local address.

The set up is a cisco 3750 -> 3560 switch -> servers. All hosts are pingble via the router.

The NAT is being set up similar to this:

int fa0/0.1
ip address
ip nat inside

int gig0/0
ip address
ip nat outside

ip nat inside source list 1 interface GigabitEthernet1/0 overload
ip nat inside source static tcp 22 22 extendable

access-list 1 permit

With show ip nat translations I can see the mapping. When the public IP is nmap'd it comes up as 22/filtered and I'm not allowed to connect.

With lft(layer 4 traceroute), i.e. lft <ip>:22 the router and the switch behind it return nothing but the server comes back with open.

Its as if the NAT almost works.

share|improve this question

migrated from May 25 '11 at 20:06

This question came from our site for professional and enthusiast programmers.

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.