I have two Cisco ADSL modems configured conventionally to nat the inside traffic to the ISP. That works.

I have two port forwards on one of them for SMTP and IMAP from the outside to the inside this provides external access to the mail server. This works.

The modem doing the port forwarding also terminates PPTP VPN traffic.

There are two DNS servers one inside the office which resolves mail to the local address, one outside the office which resolves mail for the rest of the world to the external interface. That all works.

I recently added an IPSec VPN between the two modems and that works for every thing EXCEPT connections over the IPSec VPN to the mail server on port 25 or 143 from workstations on the remote lan.

It would seem that the modem with the port forwards is confusing traffic from the mail server destined for a machine on the other side of the IPSec VPN for traffic that should go back to a port forward connection.

PPTP VPN traffic to the mail server is fine.

Is this a scenario anybody is familiar with and are there any suggestions on how to work around it?

Many thanks


But wait there is more.....

This is the strategic parts of the nat config. A route map is used to exclude the lans that are reachable via IPSec tunnels from being Nated.

int ethernet0
  ip nat inside

int dialer1
  ip nat outside
  ip nat inside source route-map nonat interface Dialer1 overload

route-map nonat permit 10
  match ip address 105

access-list 105 remark *** Traffic to NAT
access-list 105 deny   ip
access-list 105 deny   ip
access-list 105 permit ip any

ip nat inside source static tcp 25 interface Dialer1 25
ip nat inside source static tcp 143 interface Dialer1 143

At the risk of answering my own question, I resolved this outside the Cisco realm.

I bound a secondary ip address to mail server, changed the port forwards to use it while leaving all the local and IPSec traffic to use and the problem was solved.

New port forwards.

ip nat inside source static tcp 25 interface Dialer1 25
ip nat inside source static tcp 143 interface Dialer1 143

Obviously this is a messy solution and being able to fix this in the Cisco would be preferable.


It seems to me you have nat exemption for the internal networks on either side. That is correct?

If so, make a route-map for the port forwards too, and specifically deny such when source is the remote network.

| improve this answer | |
  • I would love to fix this in the cisco, I have a messy solution in place in the mean time. Any suggestions would be very interesting. Thank you for you kind offer of an example. – Alan Apr 18 '11 at 13:26

I have struggled with this on many occasions myself, turns out the simplest of solutions...

you have to change how the port forwards are applied instead of binding to the external interface, you bind to the route-map. a bit strange why it doesn't just work, but I am glad to have it fixed now after a huge amount of trawling the net, this was the closest thing i found to an answer!!

So FYI, if you use the following code for your port forwards, things should behave as expected

ip nat inside source static tcp 25 <external-ip> 25 route-map nonat
ip nat inside source static tcp 143 <external-ip> 143 route-map nonat

The only issue with this is that it doesn't really cater for port forwards when you have an external ip that is dynamic - but you wouldn't be doing ipsec VPNs then so it shouldn't effect many!

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.