Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have been trying to get port forwarding working with a newly installed cisco router. I cannot seem to find where my fault is and have been looking for quite a while.

The relevant section of my config:

interface FastEthernet0/0
 ip address dhcp
 ip nat outside
 speed 100
 no cdp enable
interface FastEthernet0/1
 ip address
 ip nat inside
 speed 100
router eigrp 250
 passive-interface FastEthernet0/0
 no auto-summary
ip nat inside source list NAT interface FastEthernet0/0 overload
ip nat inside source static udp 9987 interface FastEthernet0/0 9987
ip nat inside source static tcp 30033 interface FastEthernet0/0 30033
ip nat inside source static tcp 10011 interface FastEthernet0/0 10011
ip nat inside source static tcp 22 interface FastEthernet0/0 443
ip nat inside source static tcp 80 interface FastEthernet0/0 80
no ip http server
no ip http secure-server
ip classless
ip route FastEthernet0/0 dhcp
ip access-list extended NAT
 permit ip any any

There has to be an issue with my config somewhere? Or am I missing something necessary to get port forwarding working?

Here is the current NAT table stripped down to show only my rules:

cisco2621#show ip nat tran
Pro Inside global         Inside local          Outside local         Outside global
udp x.x.x.x:9987    ---                   ---
tcp x.x.x.x:10011   ---                   ---
tcp x.x.x.x:80      ---                   ---
tcp x.x.x.x:443      ---                   ---
tcp x.x.x.x:30033   ---                   ---
share|improve this question
from another friend. "I think it may be the access list. You are trying to forward TCP and UDP Ports but only have IP in the access list." – user169339 Apr 13 '13 at 4:02
can you add an output of show ip nat translations? – DukeLion Apr 13 '13 at 5:00
@DukeLion Sorry for the delay, I was away. I updated the question to include the NAT table – h3rrmiller Apr 15 '13 at 16:10
Which router/IOS is it? – Konrad Gajewski Jun 28 '15 at 10:21

Been a long time since I've done NAT'ing, but on your "ip nat inside ..." lines, can you put an interface at the end? I thought it needed to be the appropriate IP address of the interface. In your config, however, it might work due to DHCP.

Try the following commands to help narrow down issues:

show ip nat translations
debug ip nat (then try to generate traffic that should hit the NAT and see what hits the console)
show ip nat stat

Also, since you aren't filtering anything at this point, try not using an extended access list. Shouldn't make a difference, but it's 3 seconds worth of trying.

access-list 10 permit any
share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.