PC cannot connect to internet but ping from router works

[nick.sharpley]

I know .... a common problem discussed many times on many forums.   Cisco router can ping out but connected workstation cannot.

I've set these up many, many times ... hence my frustration this time when I know the config is right but something is still blocking the traffic.

Config below ... I can ping 8.8.8.8 from the router, I can ping www.google.com from the router ... both are fine (confirming DNS from the router is fine).

NAT should all be fine.   ip nat rule is good, ip route is good ... but still no dice.

The one puzzling thing is the ip name-server commands wont hold on the router but all other config changes do hold.

What have I missed??

Current configuration : 1235 bytes
!
version 12.4
service timestamps debug datetime msec
service timestamps log datetime msec
no service password-encryption
!
hostname test
!
boot-start-marker
boot-end-marker
!
enable secret 5 $1$8/ux$/TUKqfrV4y4ywMiFj8cSA.
!
no aaa new-model
ip cef
!
!
ip auth-proxy max-nodata-conns 3
ip admission max-nodata-conns 3
no ip dhcp use vrf connected
!
ip dhcp pool test
network 192.168.151.0 255.255.255.0
dns-server 192.231.203.132 192.231.203.3
default-router 192.168.151.254
!
!
ip domain name ****.local
!
!
!
username admin privilege 15 password 0 *******
!
!
interface FastEthernet0/0
ip address 192.168.151.254 255.255.255.0
ip nat inside
ip virtual-reassembly
duplex auto
speed auto
!
interface FastEthernet0/1
ip address dhcp
ip nat outside
ip virtual-reassembly
duplex auto
speed auto
!
ip default-gateway 150.101.252.99
ip forward-protocol nd
ip route 0.0.0.0 0.0.0.0 FastEthernet0/1
!
ip http server
no ip http secure-server
ip nat source list 101 interface FastEthernet0/1 overload
ip dns server
!
access-list 101 permit ip any any
!
!
control-plane
!
!
line con 0
logging synchronous
login local
line aux 0
line vty 0 4
login local
transport input ssh
!
scheduler allocate 20000 1000
end

[Francesco Molino · Accepted solution]

Hi

You're using ip nat source while on interfaces you've ip nat inside and ip nat outside.

If you want to keep ip nat source then you'll need to use  ip nat enable  on interfaces.

If you want to keep your interfaces as is then you should change your nat config like ip nat inside source .... (rest remains as is).

Just a recommendation, on Nat acl, I'll add few lines before the permit any any by denying communications between RFC1918 subnets to avoid Nat on these subnets.

[nick.sharpley]

Well f&%k me!  That was it!

And I thought I knew what I was doing ... 

Thanks ... !!!

[Francesco Molino]

No problem 😀
You're welcome.