Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm trying to forward a port to an inside server. I have tried using static nat to forward it and I have opened it up in the access list as far as I know but I can't seem to get it to open.

share|improve this question
What's your current config (remove the passwords and remove or change sensitive details), and what have you tried? – Shane Madden Sep 27 '11 at 0:41
Tried show ip nat trans? – poige Sep 27 '11 at 1:22

The command is

ip nat inside source static <internal address> <public address>

for NATing the an entire IP, or

ip nat inside source static tcp <internal address> <port> <public address> <port>
ip nat inside source static udp <internal address> <port> <public address> <port>

For specifc udp or tcp ports.

Then you need to have an access list on the outside interface that permits access to the port on the public address.

Also, make sure you have ip nat inside on the inside interface and ip nat outside on the outside interface

Update 1

The access-list bound to the external interface needs to include a rule to allow the incoming connection. Lets say you have port 80 is the port you want to forward. Lets also say that Dialer0 is your outside interface and FastEthernet0 is your inside, and is the internal IP address:

interface FastEthernet 0
    ip nat inside
interface Dialer 0
    ip nat outside
    ip access-group outside-in in
ip nat inside source static tcp 80 interface Dialer0 80

ip access-list extended outside-in
    permit tcp any any eq 80
    deny ip any any

Note that with this example, I have bound the NAT to the Dialer0 interface so that we don't need to hard code the IP address into the config - it will take whatever address the D0 interface has as the public address.

Also note that the permit command in the access-list allows access to any IP on port 80. Only use this method if the router does not route other addresses than the one used for the outside interface. Otherwise, hardcode host <ip address> where the IP address is that of the outside interface in place of the second "any"

share|improve this answer
I have tried that and it won't seem to open it up. It shows up as in the nat translations as tcp --- --- Now what do I have to put in the ip nat outside to get it to be open to all hosts outside the network – Anonymous Sep 28 '11 at 1:35
I have all this as you do and it still will not let me connect on the port I am trying to. We have a shared network drive we would like to access out of network so I am trying to allow port 445 through and I cannot seem to get it to work properly. I will post my running-config tomorrow when I get the chance. Whats also interesting is that I can connect out of network to the router it self via telnet if I want but I cannot seem to get it to allow 445 – Anonymous Sep 28 '11 at 6:25
Ok so this is the mess of a configuration I have inherited when I took this over: – Anonymous Sep 28 '11 at 20:21
The config looks right - are none of the port forwards working, or just the specific 445 one? Also, could you paste a sh access-list 105 and a sh ip route. The first will confirm that attempts are getting to the router, and the second will check nothing is funky with the route your isp is giving you. – Paul Sep 28 '11 at 23:40
Ok here you go – Anonymous Sep 29 '11 at 4:11

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.