Hello,
I am having an issue configuring a one-to-one NAT for a local PBX server to a Single WAN IP, while also Dynamically NATing all other local traffic to another block of IPs provided by the same ISP on the same physical WAN connection. Here is my dilemma:
We were given a public ip of 1.1.1.2/30 which we have to use for the PBX (local 192.168.1.42) and 10.10.10.0/29 as a usable range as well on the same link for any other traffic. I am currently using 10.10.10.2/29 and I can access the router remotely with this IP address and the pbx is able to receive and make calls without issue, but while on the network, users are not able to browse to any site. I can confirm internet access from the router's local interface by pinging google and it works without issue but web-traffic just doesn't seem to work at all. I have stripped down all configurations to the bare bones (no firewall rules or ACLs filtering any web traffic, the router is just routing packets) and have added them below.
There is a Secondary router configured in the same exact way but without the PBX configurations and that device works without issue. Looking at all the NAT translations, it seems like DNS specifically isn't working as that is almost all the traffic I see in the NAT table but I don't see why that would not work.
ip dhcp pool LAN
network 10.0.0.0 255.255.255.0
default-router 10.0.0.1
dns-server 208.67.222.222 208.67.220.220
interface Gigabitethernet0/0/0
ip address 10.10.10.2 255.255.255.248 secondary <--Public LAN IP
ip address 1.1.1.2 255.255.255.252 <--Public IP
ip nat outside
interface gigabit 0/0/1
ip add 10.0.0.1 255.255.255.0
ip nat inside
ip nat pool WAN2 10.10.10.2 10.10.10.2 netmask 255.255.255.248
ip nat inside source static udp 192.168.1.42 5060 1.1.1.2 5060 extendable
ip nat inside source static tcp 192.168.1.42 8089 1.1.1.2 8089 extendable
ip nat inside source static 192.168.1.42 1.1.1.2 route-map PBX-ACL-RM extendable
ip nat source route-map NAT-RM interface GigabitEthernet0/0/0 overload
ip nat inside source list NAT pool WAN2 overload
ip route 0.0.0.0 0.0.0.0 1.1.1.1
ip access-list ext NAT
permit ip 10.0.0.0 0.0.0.255 any
permit ip 192.168.1.0 0.0.0.255 any
ip access-list extend PBX-ACL
permit host 192.168.1.42 host x.x.x.x
permit host 192.168.1.42 host x.x.x.x
permit host 192.168.1.42 host x.x.x.x
route-map PBX-ACL-rm permit 20
match ip address PBX-ACL
route-map NAT-RM permit 10
match ip address NAT
Pinging 8.8.8.8 sourcing from a local interface succeeds and the PBX is able to reach out to the specific hosts without issue but local LAN web traffic just doesn't resolve anything. Any help would be greatly appreciated.
