Please Help - Static NAT not working.

Sean Franklin · ‎05-03-2015

I feel like I've tried everything. I'm trying to port-forward to an IP camera. I have ddns setup, and when I type in my domain name I get to my router, so ddns is working correctly. However when I type it in with the port of my camera I'm getting nothing. When I do a show ip nat statistics I see that there have been no static translations. Below is my config.

FranklinRouter#sh ip nat translations | i 8090
tcp 72.x.x.217:8090 10.1.1.101:8090 --- ---
udp 72.x.x.217:8090 10.1.1.101:8090 --- ---
FranklinRouter#

FranklinRouter#sh ip nat statistics
Total active translations: 172 (0 static, 172 dynamic; 172 extended)
Peak translations: 3425, occurred 1w2d ago
Outside interfaces:

interface GigabitEthernet0
description Access to the Internet via this interface
ip address dhcp
ip access-group 101 in
no ip redirects
no ip unreachables
no ip proxy-arp
ip flow ingress
ip nat outside
ip inspect DEFAULT100 out
ip virtual-reassembly in
duplex auto
speed auto

!
ip http server
ip http access-class 23
ip http authentication local
ip http secure-server
ip http timeout-policy idle 60 life 86400 requests 10000
ip nat inside source list 1 interface GigabitEthernet0 overload
ip nat inside source static tcp 10.1.1.101 8090 interface GigabitEthernet0 8090
ip nat inside source static udp 10.1.1.101 8090 interface GigabitEthernet0 8090
ip route 0.0.0.0 0.0.0.0 72.x.x 254
ip route 0.0.0.0 0.0.0.0 72.x.x 254
!
ip access-list extended inboundfilters
permit eigrp any any
deny icmp any any
evaluate tcptraffic
ip access-list extended outboundfilters
permit tcp any any reflect tcptraffic timeout 300
!
logging trap notifications
access-list 1 permit 10.10.10.0 0.0.0.7
access-list 1 permit 10.1.1.0 0.0.0.255
access-list 23 permit 10.1.4.0 0.0.0.255
access-list 23 permit 10.1.0.0 0.0.255.255
access-list 100 deny ip host 255.255.255.255 any
access-list 100 deny ip 127.0.0.0 0.255.255.255 any
access-list 100 permit ip any any
access-list 101 permit udp object-group DNS any eq domain
access-list 101 permit udp object-group NTP any eq ntp
access-list 101 permit udp any eq bootps any eq bootpc
access-list 101 deny ip 10.10.10.0 0.0.0.255 any
access-list 101 permit icmp any any echo-reply
access-list 101 permit icmp any any time-exceeded
access-list 101 permit icmp any any unreachable
access-list 101 deny ip 10.0.0.0 0.255.255.255 any
access-list 101 deny ip 172.16.0.0 0.15.255.255 any
access-list 101 deny ip 192.168.0.0 0.0.255.255 any
access-list 101 deny ip 127.0.0.0 0.255.255.255 any
access-list 101 deny ip host 255.255.255.255 any
access-list 101 deny ip any any log
access-list 101 permit ip any any log
!
!
!
!
!
!

Richard Burts · ‎05-03-2015

The first issue that I notice is that the interface has an inbound access list 101 and I do not see anything in access list 101 that would permit inbound traffic to port 8090 for either TCP or UDP. If the traffic is not permitted in the inbound access list then how do you expect it to be translated?

HTH

Rick

HTH

Rick

Sean Franklin · ‎05-04-2015

Thanks for your response Rick.

That was one of the first things I checked since I've had issues with the ACL before with dns and ntp. I pinned those down with the deny log, which is still configured. I haven't gotten a single log message related to this connection. So I removed the acl entirely just to be sure and I still wasn't able to get through.

I got desperate last night after troubleshooting this all day and I brought up WireShark to see what was going on. I was getting a response from my public IP when I entered my ddns:port in the browser so I know that part of it is working. The response I was getting however was a connection reset, so something is happening on the router.

I tried debugging ip nat, and I didn't get anything related. Which makes sense since I haven't seen a single static connection in the sho ip nat statistics. I brought up ccp just for giggles to see if I configured static nat wrong. When I went to configure the port-forwarding it wouldn't issue the configs because it said that there were already identical configurations (my statics were right).

My only other idea is to debug all packets when I get home to see if I can get any feedback. Other than that I'm stumped.

Sean Franklin · ‎05-04-2015

Right now I'm debating between dropping 120 bucks on the SMARTnet so I can ask Cisco and upgrade the IOS, or spend that money on a asa 5505 and move the port forwarding to that. All of the discussions that I've seen on the internet with people having these problems are unresolved.

Jon Marshall · ‎05-04-2015

Sean

Have you removed all acls ?

Can you post your current configuration that you are working with ?

Jon

Sean Franklin · ‎05-04-2015

I'll post the full config when I get home. I have removed the ACLs entirely and it still didn't work. I did a debug of all tcp and basically I just saw what WireShark had been showing me. The syn and reply with a rst connection. I wasn't able to see anything else. Nothing comes up when I debug NAT because it looks like it's not making it that far.

Sean Franklin · ‎05-04-2015

The ACL is removed. It's still not working. I did a "debug ip tcp packet" and I'm getting the same thing that I got yesterday. The router is sending a RST immediately when I request. Since like I said I was getting no deny logs on my acl as I expected to get, and I'm getting no ip nat translations, I'm thinking that somehow it's not even making it that far. Here is the tcp debug.

001468: May 4 17:25:40.955 EST: tcp0: I LISTEN 10.1.1.54:50135 72.1x7:8091 seq 4241027909
001469: May 4 17:25:40.955 EST: TCP: sent RST to 10.1.1.54:50135 from 72.x.217:8091
001470: May 4 17:25:41.095 EST: tcp0: I LISTEN 10.1.1.54:50136 72.1x217:8091 seq 3260670412
001471: May 4 17:25:41.095 EST: TCP: sent RST to 10.1.1.54:50136 from 72.x.217:8091
001472: May 4 17:25:41.227 EST: tcp0: I LISTEN 10.1.1.54:50137 72.1x17:8091 seq 3302126319

Every discussion I've seen on this on the internet has ended unresolved, so I think that it's important to figure out what is going on here.

Richard Burts · ‎05-04-2015

Thanks for providing additional information. I am curious about one aspect of the debug output. The source address that it shows is10.1.1.54.

How is the source address of a packet being sent to an interface with a public IP have a source address in an unroutable network?

HTH

Rick

HTH

Rick

Richard Burts · ‎05-04-2015

And not only is the source address of the packet arriving on the outside interface a private address but it falls into the subnet of vlan1.

HTH

Rick

HTH

Rick

Sean Franklin · ‎05-04-2015

This is where I start to get a bit lost as NAT is not my strong point.

Sean Franklin · ‎05-04-2015

Ahah! I've made a revelation. Don't laugh but when I was testing on my phone as my "external test" it wasn't really external as I forgot it was connected via wifi. So really it was an internal test.

So when I disconnected the wifi it still didn't work BUT I got a deny log which is what I expected originally. I just need to edit the acl. So the real problem here is why can't internal users use the ddns to get to my cameras.

I think they're never being translated because if I do a traceroute to my ddns there is only one hop and that's my external address. So if it never really exits the interface can it come back in?

Richard Burts · ‎05-04-2015

We have made progress. And it is another demonstration that the more information we have to work with the better we are able to identify issues impacting the desired result.

And it confirms that the basic issue seems to be related to the access list.

This is not an unusual problem when devices inside need to access a device which is also accessed from outside. The optimum solution is a DNS for inside which will resolve the server address to its inside/private address and is separate from the external DNS which resolves the server name to its public address.

HTH

Rick

HTH

Rick

Sean Franklin · ‎05-05-2015

Thanks for all of the help Rick. Now I'm definitely out of my wheelhouse.

I have 3 public dns servers configured on my dhcp scope. Is this as simple as configuring myself an internal DNS server with the static entry (on my nas or centOS server) and changing the order of my dns servers?

Jon Marshall · ‎05-05-2015

Sean

That is the simplest solution yes.

You can if you want try to have the internal clients connect to the public IP and then the router translate it back to the private IP but that really can be tricky to get working.

Generally with an internal DNS server you would only hand out it's IP to the clients and then on the DNS server itself you would configure the other public IP DNS servers as forwarders ie. if your internal DNS server doesn't have a record it forwards it on to the one of the public DNS servers.

Like I say it's that or trying to get NAT to allow public to private IP for your internal clients.

Jon

Sean Franklin · ‎05-05-2015

Thanks Jon,

I'd rather not make my NAT configuration more complex. I suppose what I could do in lieu of requiring my DNS server to be up 24/7 is configure the router to the be the dns server with the static entry then have it forward to the public DNS servers. Does that sound like a good solution?