Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I've got a Cisco 1841 router. I've been trying to configure NAT overload on it, such that its subnet can access the internet. By the looks of things, I've configured everything right. I'm not sure, though, first time I've ever done this.

Here's my config.

Cisco1841#show config
Using 1095 out of 196600 bytes
!
version 12.4
service timestamps debug datetime msec
service timestamps log datetime msec
no service password-encryption
!
hostname Cisco1841
!
boot-start-marker
boot-end-marker
!
enable secret 5 [redacted]
enable password [redacted]
!
no aaa new-model
!
resource policy
!
mmi polling-interval 60
no mmi auto-configure
no mmi pvc
mmi snmp-timeout 180
ip subnet-zero
no ip cef
!
!
no ip dhcp use vrf connected
!
!
ip domain name [redacted]
!
!
!
!
interface FastEthernet0/0
 ip address 10.32.32.42 255.255.254.0
 ip nat outside
 duplex auto
 speed auto
 no mop enabled
!
interface FastEthernet0/1
 description $ES_LAN$
 ip address 192.168.200.1 255.255.255.128
 ip nat inside
 duplex auto
 speed auto
 no mop enabled
!
ip default-gateway 10.32.32.1
ip classless
!
ip http server
ip nat pool pool1 192.168.200.1 192.168.200.1 netmask 255.255.255.128
ip nat inside source list 1 pool pool1 overload
!
access-list 1 permit 192.168.200.0 0.0.0.254
dialer-list 1 protocol ip permit
!
control-plane
!
!
line con 0
line aux 0
line vty 0 4
 password [redacted]
 login
!
end

Is there anything obviously wrong with this? Or is it just a problem in the host network's config that's preventing me from accessing the internet? (Computers outside this subnet CAN access the internet)

share|improve this question
add comment

1 Answer 1

up vote 2 down vote accepted
  • The inverse mask of access-list 1 should be 0.0.0.127
  • The ip default-gateway statement should be replaced by an ip route 0.0.0.0 0.0.0.0 statement
  • The IP pool should use IP addresses from the outside interface's subnet, from some other public subnet routed to the outside interface from the upstream router, or should nat to the interface itself without using an IP pool.
share|improve this answer
    
Okay. I applied those fixes. And, when tracerouting to Google's public DNS (8.8.8.8) from the subnet, instead of the router claiming it's an unknown host as it was before, it's now timing out. The router itself can see it, though. –  Yoplitein Aug 2 '11 at 19:23
    
Your IP pool should also be made of "public" IP addresses that fit into the subnet of the outside interface. Alternatively, you can nat to the interface instead of using a pool. –  JakePaulus Aug 2 '11 at 19:56
    
That did it. We're up and running now. Thanks! –  Yoplitein Aug 2 '11 at 21:52
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.