I have cisco ios router with ios C1900 Software (C1900-UNIVERSALK9-M), Version 15.2(4)M1. And I have setup Nat with port overload (one public IP). And there is a static mapping:

ip nat source static tcp 7780 interface GigabitEthernet0/0 80

Which works fine if I try to access web server from other isp's. (GE0/0 - ext interface, GE0/1 - internal interface) So when traffic goes from GE0/0 to GE0/1.

But when I want to access it from internal network (GE0/1) packet does not go to destination host. NVI nat table entry is created for this connection but packet's are not reaching So is this possible that nat outside address will work as port forward for inside nat pool ?

EDIT: Src ip is from local subnet i.e. but I'm accessing wan addres i.e. that is assigned to GE0/0 external WAN interface, so traffic goes through router.


What is your source IP? If you're accessing from something in the same subnet as the server, the traffic will never hit the router and won't get NAT'd.

Also, you may be mixing your tech here. The command you gave uses the new-style NVI NAT and treats all NAT-enabled interfaces as inside. But you're referring to outside interfaces as though you've defined them.

Can you give us the config you have for your NAT statements, your ACLs, and interfaces?


The first problem you're going to have is return packet forwarding from the webserver to the client. Imagine the following flow:

Source IP  Source Port 64000
Destination IP  Destination port 7780

This packet hits the router and gets changed to the following

Source IP Source Port 64000
Destination IP Destination Port 80

This packet then gets sent to the server, which will attempt to REPLY to !! This will bypass the router (Layer 2) so the client will see the reply packet as:

Source IP Source Port 80
Destination IP Source Port 64000

This is a problem - the client expects the source to be ! This is solvable with a route on the server forcing all local traffic back through the router - but that will affect a lot of traffic and I wouldn't really recommend it. If you put the Webeserver off of a different interface (or VLAN) on the router you may have an easier go of this...


The key was to add:

no ip redirects

on nat interfaces. It worked.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.