topic Re: NAT / Port forwarding not working in Routing and SD-WAN

NAT / Port forwarding not working

Y. 'FoAmY' Vandenbossche — Fri, 26 Apr 2019 15:18:36 GMT

Hi guys,

I'm having some issues with port forwarding on my 1921 ISR, it was all working fine about a week ago... Then overnight (isr restarted due to power failure) it stopped working... I've gone over my config again, and again... Checked IP addresses, firewalls and tested connecting from the LAN and all works as expected. 'I just can't seem to connect from the outside -> in 😞

controller VDSL 0/0/0
!
interface GigabitEthernet0/0
no ip address
duplex auto
speed auto
!
interface GigabitEthernet0/0.10
encapsulation dot1Q 10
ip address 192.168.10.254 255.255.255.0
ip nat inside
ip virtual-reassembly in
no cdp enable
!
interface ATM0/0/0
no ip address
shutdown
no atm ilmi-keepalive
!
interface Ethernet0/0/0
mac-address 7050.afb7.c5da
no ip address
ip nat outside
ip virtual-reassembly in
!
interface Ethernet0/0/0.101
encapsulation dot1Q 101
ip dhcp client request classless-static-route
ip dhcp client client-id hex ************************************
ip dhcp client hostname ************@*****|********
ip address dhcp
no ip redirects
no ip proxy-arp
ip nat outside
ip virtual-reassembly in
!
ip route 0.0.0.0 0.0.0.0 dhcp
!
ip nat inside source list 100 interface Ethernet0/0/0.101 overload
access-list 100 permit ip 192.168.10.0 0.0.0.255 any
!
ip nat inside source static tcp 192.168.10.202 80 interface Ethernet0/0/0.101 8880

Thanks in advance for any help!

Re: NAT / Port forwarding not working

Jaderson Pessoa — Fri, 26 Apr 2019 15:23:20 GMT

This 192.168.10.202 80 is accessible from internal clients?

Re: NAT / Port forwarding not working

Y. 'FoAmY' Vandenbossche — Fri, 26 Apr 2019 15:56:17 GMT

Hi Jaderson,

Yes, it is. 🙂

Re: NAT / Port forwarding not working

paul driver — Fri, 26 Apr 2019 16:11:05 GMT

Hello

from the rtr if you telnet to 192.168.10.202 80 source gig0/0.10 - do you get connection?

From outside telnet again to your public IP address on port 8880

sh ip nat translations

Re: NAT / Port forwarding not working

Jaderson Pessoa — Fri, 26 Apr 2019 16:11:01 GMT

@Y. 'FoAmY' Vandenbossche try it;

no ip nat inside source static tcp 192.168.10.202 80 interface Ethernet0/0/0.101 8880  < certify the port

clear interface ethernet0/0/0.101

clear counters ethernet0/0/0.101

shutdown and shutdown under interface 0/0/0.101

ip nat inside source static tcp 192.168.10.202 80 interface Ethernet0/0/0.101 8880 < certify the port

maybe it is a bug

Re: NAT / Port forwarding not working

Y. 'FoAmY' Vandenbossche — Fri, 26 Apr 2019 16:21:15 GMT

from the rtr if you telnet to 192.168.10.202 80 source gig0/0.10 - do you get connection? : yes, connects fine...

From outside telnet again to your public IP address on port 8880 : no connection, times out 😞

VDB-R1# sh ip nat trans
tcp xxx.xxx.xxx.xxx:8880   192.168.10.202:80     ---                   ---

Re: NAT / Port forwarding not working

Y. 'FoAmY' Vandenbossche — Fri, 26 Apr 2019 16:24:32 GMT

Tried that already, just tried again... No dice 😞

Re: NAT / Port forwarding not working

Jaderson Pessoa — Fri, 26 Apr 2019 16:45:08 GMT

If you change this port 8880 to another ports, its working?

Re: NAT / Port forwarding not working

paul driver — Fri, 26 Apr 2019 16:56:59 GMT

Hello

Shouldn't really make much difference but can you try using another source port maybe tcp 80 and amend the acl to deny that host from the dynamic nat

access-list 100 permit deny host 192.168.10.202 any
access-list 100 permit ip 192.168.10.0 0.0.0.255 any

Re: NAT / Port forwarding not working

Y. 'FoAmY' Vandenbossche — Fri, 26 Apr 2019 20:40:03 GMT

Indeed this fixes it, I guess I'll come up with another port to use!

Thanks for your help everyone!

Re: NAT / Port forwarding not working

Jaderson Pessoa — Fri, 26 Apr 2019 21:11:46 GMT

Great, maybe theret this port stayed in block state in your router "bug" i dont know..

But great that your problem was solved.

🙂