Static NAT mapping is not working

[tkalfaoglu]

Hi. I thought I had this down pat, but it turns out I didn't.

This is a CISCO 3925.. Single outbound IP, and a bunch of LAN clients using

192.168.x.x 

very typical setup.
NAT is working fine, except I can't allow an incoming port to be mapped.

I have a DNS server running locally at port 5333.  LAN hosts can access it, no problems.

I would like the world to access it as port 53.

My remote IP is, 193.162.105.108.  The DNS server is at 192.168.1.191

This is not working:

ip nat inside source list 1 interface Dialer1 overload
ip nat inside source static tcp 192.168.1.191 53 193.162.105.108 5333 extendable
ip nat inside source static udp 192.168.1.191 53 193.162.105.108 5333 extendable

interface GigabitEthernet0/1
ip nat inside

interface Dialer1
ip nat outside
ip nat enable

I also have

access list

in, but it permits both 53 and 5333 for UDP and TCP.

I'll enclose the entire file in case it helps..

Many thanks, -t

[MHM Cisco World]

ip nat inside source list 100 interface Dialer1 overload
ip nat inside source static tcp 192.168.1.191 53 193.162.105.108 5333 extendable
ip nat inside source static udp 192.168.1.191 53 193.162.105.108 5333 extendable

!

Ip access-list standard 100

Deny tcp/udp 192.168.1.191 53 any 

Permit ip 192.168.1.0 0.0.0.255 any 

You need to

deny tcp/udp

traffic form NATing overload 

By the way

dns use udp not tcp

[tkalfaoglu]

Many thanks. When I did that, the

192.168.1.191

could not reach the internet.. therefore it was useless as a DNS server ..

[MHM Cisco World]

Sorry' can I see your last config

[tkalfaoglu · Accepted solution]

SOLVED.. I had to to this instead of the

nat static

lines above:

ip nat inside source static tcp 192.168.1.191 5333 interface Dialer1 53
ip nat inside source static udp 192.168.1.191 5333 interface Dialer1 53

This routes ALL port 53 traffic to that one server's 5333 port.. it works!

[MHM Cisco World]

So server ise 5333 not known port 53.

Anyway glad your issue solved 

Have a nice summer 

MHM

[tkalfaoglu]

Many thanks - there are actually TWO DNS servers running on that machine, that's why one of them is at a non-standard port..