Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have a Cisco router that we have people VPN into. Everything works great until they try to connect to a port that is statically mapped to the outside for example I have a mail host that is accessible to the outside world on port 25. To achieve this I have the following in my config.

ip nat inside source static tcp 192.168.x.x 25 interface myinterface 25

when I am connected to the vpn I can ping the host 192.168.x.x but I can't connect to port 25. people inside the network can connect to the port and it is available to the internet at the interface address.What am I missing? Thanks in advance for the help

share|improve this question
When the VPN is up can you hit port 25 on the external interface address? – tomjedrz Nov 18 '09 at 18:26
Yes you can access it on the external interface address. I would just like to know how to have the static map ignored for the vpn – trent Nov 18 '09 at 18:52
up vote 1 down vote accepted

Never done exactly what you want. But I think it might be that you would just make a static nat entry using a route map. And then in the route map, have match ACL_NUMBER. Then in that ACL, don't permit the VPN traffic.

This Cisco post might help you.

share|improve this answer
Actually, you might be able to do it for a source list as well. ip nat inside source list.... – Kyle Brandt Nov 18 '09 at 19:47
I think that will work just testing it now – trent Nov 18 '09 at 20:12
The rule that did it for me was ip nat inside source static tcp 192.168.x.x 25 outsideip 25 route-map nonat extendable I then created route-map nonat deny 10 match ip address 110 and then put in access-lit 110 deny ip myvpnaddress 192.168.x.x – trent Nov 18 '09 at 21:40

I suspect that the NAT is taking precedence over the VPN. When you ping the 192.168.x.x through the VPN, the return traffic hits the firewall and sends it through the VPN. When you try and use port 25, I expect that the return traffic hits the firewall and is NAT'ed instead of going through the firewall.

I don't know the ins and outs of IOS, but you should be able to change the precedence and have the VPN operate "above" NAT. There may also be setting on the VPN config telling it to ignore NAT in the VPNs.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.