887VM - Port Forwarding not working

[libbie-rose]

Hi, I'm setting up our 887 on our VDSL. I have got the connection sorted and I can get on the internet. I am having some issues though with my port forwarding, please see my config below.

Thank you in advance for your help, I sure i'm probable missing something simple but I just can't see why its not working at the moment I'm just trying to do port 80 to 192.168.11.3:80 

Libbie :)

Router#sh run
Building configuration...

Current configuration : 2069 bytes
!
! Last configuration change at 07:38:36 UTC Tue Sep 13 2016
version 15.3
no service pad
service timestamps debug datetime msec
service timestamps log datetime msec
no service password-encryption
!
hostname Router
!
boot-start-marker
boot-end-marker
!
!
enable secret 5 ********************************
enable password *****************
!
no aaa new-model
memory-size iomem 10
!
!
!
!
!
!

!
!
!
!
ip name-server 8.8.8.8
ip name-server 8.8.4.4
ip cef
no ipv6 cef
!
!
multilink bundle-name authenticated
license udi pid CISCO887VA-SEC-K9 sn FCZ1747C2WU
!
!
!
!
!
!
!
controller VDSL 0
!
!
!
!
!
!
!
!
!
!
interface Ethernet0
no ip address
!
interface Ethernet0.101
encapsulation dot1Q 101
pppoe enable group global
pppoe-client dial-pool-number 1
!
interface ATM0
no ip address
shutdown
no atm ilmi-keepalive
!
interface FastEthernet0
no ip address
!
interface FastEthernet1
no ip address
!
interface FastEthernet2
no ip address
!
interface FastEthernet3
no ip address
!
interface Vlan1
description LAN
ip address 192.168.11.249 255.255.255.0
ip nat inside
ip virtual-reassembly in
!
interface Dialer1
description Dialer interface for VDSL
mtu 1492
ip address negotiated
no ip redirects
no ip unreachables
no ip proxy-arp
ip nbar protocol-discovery
ip flow ingress
ip nat outside
ip virtual-reassembly in
encapsulation ppp
ip tcp adjust-mss 1452
dialer pool 1
ppp authentication pap chap ms-chap callin
ppp chap hostname ****************@b2bdsl
ppp chap password 0 ***************
ppp ipcp address accept
no cdp enable
!
ip forward-protocol nd
no ip http server
no ip http secure-server
!
!
ip nat inside source list NAT interface Dialer1 overload
ip nat inside source static tcp 192.168.11.3 80 interface Dialer1 80
ip route 0.0.0.0 0.0.0.0 Dialer1
!
ip access-list extended NAT
permit ip 192.168.11.0 0.0.0.255 any
remark Access list for NAT
!
dialer-list 1 protocol ip permit
!
snmp-server community public RO
!
control-plane
!
!
!
line con 0
no modem enable
line aux 0
line vty 0 4
password ************
login
transport input all
!
!
end

[Mark Malone]

Hi Libbie

please edit/remove your password from the post under the VTY just in case.

Your static nat looks correct and is applied under correct interfaces

What do you see in the show ip nat translations for this connection  ?

[libbie-rose]

Hiya Mark,

Thank for your quick response, I get the following

[Mark Malone]

Ok so NAT looks to be working well and I also see port 80 translations as well in there

are you able to http to this ip locally without NAT ?

does that device have any firewall software on it or strong av software that may prevent connections

if you remove the static NAT does it work on the general NAT statement that everything else is working on ?

[libbie-rose]

I can get to 192.168.11.3:80 with no problems locally and it has been working on our old service but if in try going  88.215.5.151:80 locally I get "refused to connect" if I do it from outside the connection times out.

when you say about removing the static NAT which part do you mean? (Sorry think i'm having a really blonde day today) 

Thanks Libbie

[Mark Malone]

Hi

so I was just wondering if its something to do with the static itself even though its looks  fine

you have 2 sets of nat rules in place 1 is a specific static for .3 but you also have the full subnet it also belongs to in the overload statement

as a test if you remove this line just to see if overload picks it up instead , really you should be able to have both--- no ip nat inside source static tcp 192.168.11.3 80 interface Dialer1 80

Or another option instead of using the dialer interface in the static nat change it to the actual ip see if that works , these are just couple of things I would try

ip nat inside source static tcp 192.168.11.3 80 88.215.5.151 80

[libbie-rose]

Thanks again Mark

But no joy, tried removing each of the NAT lines and putting our public IP and still not working :(

Don't think it really means anything but I can telnet onto the router from outside, port 23 is the next port I need to forward to somewhere else, so gave it a try and no joy... making me think there is something wrong with the NAT setup

Libs 

[libbie-rose]

Mark, do I need need to add the dialer and FastEthernet3 which is connect to my network to my vlan1? could this be the issue?

Libbie

[Mark Malone]

Hi

dialer is a routed interface with diff subnet than vlan 1 so no it cannot be part of it , you have static NAT set correctly as per doc

F3 is already part of vlan 1 looking at your config default unless otherwise specified , you only require NAT inside on vlan interface and outside on dialer , if it wasn't set correctly none of your nat translations would be working , currently only the static is failing as per the outouts you gave in show ip nat translations

Configuring NAT to Redirect TCP Traffic to Another TCP Port or Address

NAT Router
interface ethernet 0 ip address 172.16.10.1 255.255.255.0 ip nat inside !--- Defines Ethernet 0 with an IP address and as a NAT inside interface. interface serial 0 ip address 200.200.200.5 255.255.255.252 ip nat outside !--- Defines serial 0 with an IP address and as a NAT outside interface. ip nat inside source static tcp 172.16.10.8 8080 172.16.10.8 80

http://www.techrepublic.com/blog/data-center/configure-static-nat-for-inbound-connections/

[libbie-rose]

Hi Mark, thanks for all your help.

I think I've sorted, the issue wasn't with the router it was elsewhere on the the network

Thanks again

Libbie 

[Mark Malone]

Ah great I was starting to think there may be an actual IOS version bug issue with static NAT  as your config looked grand