Port forwarding from Internet hosts - but not from hosts over VPN

[markmilenkovic]

Hi all.

OK - I have a server that I need to be seen from the outside world - I set up NAT and it worked fine.....but it broke communication from clients from a site on the site-to-site VPN....

so basically this router sits in our Moscow office and has a couple of site-to-site VPNs to sites in the UK.....traffic from these sites passes normally. Now when I create a static NAT rule to forward a specific port on anything connecting to the external interface to forward to the server internally it breaks communication from clients on any of the site to site VPNs - but does start port forwarding from Internet hosts.

What can I do to accomplish this kind of NAT/port forwarding so that it works for hosts on the Internet and hosts from site-to-site VPN's??

many thanks,

Mark

[andrew.prince · Accepted solution]

The solution would be Policy Based NAT.

You attach an ACL to the NAT statement - you denfine a "deny" for the internal remote L2L clients, and a permit for everything else.

HTH>

[markmilenkovic]

Hi

Thanks for that - I thought that might be the answer

i've defined my ACL.....but how do I attach this in my NAT statement

my NAT statement which I have been using (the one that breaks it over the VPN) is:

ip nat inside source static tcp 192.168.106.1 1352 interface GigabitEthernet0/0 1352

what do I do to make it use the ACL?

[markmilenkovic]

Done it.....

ok so you were right but it has to be applied using a route-map - this explains it further

http://www.cisco.com/en/US/tech/tk583/tk372/technologies_configuration_example09186a0080094634.shtml

thanks for help

[andrew.prince]

np - glad to help.