cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
Announcements

Cisco Community Designated VIP Class of 2020

189
Views
0
Helpful
3
Replies
Highlighted
Beginner

Hairpin IOS 15.x simply via snat entry ?

Hi all,

 

I've read a lot of discussions about Hairpin NAT for Cisco IOS router. Mostly about creating an NVI, PBR or split DNS.

On my Mikrotik home router I was facing this issue as well but it was easy to enable a Hairpin NAT solution, see

https://wiki.mikrotik.com/wiki/Hairpin_NAT

 

Basicly you create a SNAT entry next to de DNAT entry. I saw some discussion online (other forum) that somebody managed to do this on a Cisco router as well, but no examples were shown.

 

Is this possible on a Cisco IOS router? It seems way more simple than the other suggestions to create a Hairpin NAT rule.

 

Thanks !

 

 

Everyone's tags (2)
3 REPLIES 3
VIP Mentor

Re: Hairpin IOS 15.x simply via snat entry ?

Hello

Domain-less nat (NVI) should be able to accommodate this, As the nat order differs from domain based nat in that NVI nat performs two route lookups before and after nat translation, thus internal hosts should be able to reach their own internal web server via its local destination natted address.

 

Example:
int x/x
description wan
ip address 1.1.1.1 255.255.255.0
ip nat enable

int x/x
description Lan
ip address 192.168.1.1 255.255.255.0
ip nat enable

access-list 1 deny host 192.168.1.10
access-list permit 192.168.1.0 0.0.0.255

ip nat source static tcp 192.168.1.10 443 1.1.1.10 443
ip nat source list 1 interface (wan)





kind regards
Paul

Please rate and mark posts accordingly if you have found any of the information provided useful.
It will hopefully assist others with similar issues in the future
Beginner

Re: Hairpin IOS 15.x simply via snat entry ?

Hello Paul,

 

Thanks for your reply. Ok, so it's not possible like the way I provided in post? I read that NVI puts strain on the cpu, it's a 887 series router. Is NVI still the recommended method in this case?

 

 

VIP Mentor

Re: Hairpin IOS 15.x simply via snat entry ?

Hello

have a look at this previous post

https://community.cisco.com/t5/routing/nat-/td-p/2475807

 



kind regards
Paul

Please rate and mark posts accordingly if you have found any of the information provided useful.
It will hopefully assist others with similar issues in the future
CreatePlease to create content
Content for Community-Ad
FusionCharts will render here