Showing results for 
Search instead for 
Did you mean: 

Cisco 877 NAT, what am I missing?



I'm trying to configure a simple static NAT rule for a webserver on my 877 router but it's not working and I'm not sure why.

I have a nat overload rule based on a route-map for internet access that works fine, so the internet (at least outbound) appears to work.

The router can also ping/telnet to the port on the webserver that I need, so the path is in place.

Essentially the nat rules are:

ip nat inside source static tcp 80 dialer0 80

ip nat inside source static tcp 443 dialer0 443

I have also tried using the actual external Ip address in place of 'dialer0' but to no avail.

I can see the actual nat translations appear in 'show ipnat translations.'

The default gateway for is actually the router,, so it's only 1 hop. I have an allow any rule on the dialer interface at the moment for testing, there is no ACL on the vlan interface (with ip

Is there something I am missing? How best to debug this, are there NAT debug command (I couldn't see any).

24 Replies 24

cadet alain
VIP Alumni
VIP Alumni


You should do this:

ip nat inside source static tcp 80 dialer0 80

ip nat inside source static tcp 443 dialer0 443

Concerning the debug: debug ip nat



Don't forget to rate helpful posts.

My apologies, that's actually a typo as I re-wrote the command rather than copying them.

I've updated the original post. I'll investigate the nat debugging and post some results.

Well upon using the debug command it seemed the NAT rule is working it's just not communicating properly with it's intended destination.

I tested out connecting up a device onto the router with a subnet/vlan unique to that device and the nat rule worked fine to that, I could access it externally.

So now I'm left with working out why it's not connecting. The address is routed to a different router first. I can access both the other router and the destination IP/ports from the NATing router. My only ACL on the NATing router that is in place currently is a permit ip any any rule on the external interface and a NAT overload route-map group for internet access.

Could it be ACLs on the original router? (there are a few on there NAT overload rules and outbound/inbound restrictions on the dialer interface (I'm moving it over to the new router)). Do I need to add an ACL somewhere something like a 'permit tcp any host 80' on the old router?

How do I best debug this?

Thank you.

Does the other routers involved in this have a route to your subnet?


Yeah, I can ping from the webserver to both routers, and other subnets on both routers. I also tried setting up a NAT rule to another subnet on the 2nd router but the same thing happened (and there is proper connectivity there).

It's something to do with NATing to that other router it seems. Any debugging tips?

If I understand correctly, your set up is like this:

WebServer(your local LAN) -->router-->router-->router-->PC(destination LAN). Is this assumption correct?

Not quite, it's like this (where the dot is the interface it comes in/goes out on and the @ is the nat rule):

WebServer-->Subint.Router.Subint-->VlanIP.Router@.ADSL(Static IP)--->Internet--->RemoteClient

So it should go, for example:

Client types in>External ADSL Interface (Rtr1)-->NAT>Route to (int on Rtr2)--->Route to (subint on Rtr2)--->Send to webserver

You have only 2 routers between server and Internet, is that correct?

I assume that all subnets have /24 mask, is that correct?

Your server has an ip in subnet with default gateway of, is that correct?

Yes, all subnets are /24.

And yes, that's the IP and gateway setup I'm using.

2 Routers total

Does this look like your set up?

Almost, the address isn't actually on the interface on the ADSL router, that's the webserver IP address (instead of I may have mislead you above as I stated that it NATs to that in the diagram, but I meant more that's where the NAT rule is. The inside interface of the ADSL router is (the vlan 1 IP address) which is how it talks to the 2nd router.

So in that diagram if you replace with and replace with then that's the setup, with the NAT rule on the ADSL router.

I am able to NAT across an intermediary router right?


Try this on ADSL

ip route dialer0 (or outside int)

ip route

ip nat source static x.x.x.x (public ip on outside int)

On LAN router

ip route

Yes the outside interface is the dialer interface and the inside interfaces are the VLANs on the router

eugen barticel wrote:


Try this on ADSL

ip route dialer0 (or outside int)

ip route

ip nat source static x.x.x.x (public ip on outside int)

On LAN router

ip route

Ah, I see what you did there...

Yes this actually makes it work, once I add the default route on the other router (everything else was always in place). It would seem the packets are not going in the same path as they are going out.

However the whole reason we got this new router is so that we could set the default route on the other router to be our production ASA (this 2nd router is a redundancy link and will be used for VPN) so this doesn't suite my needs.

However as we now know the problem how can I get around it?

Could I, for example, change the NAT rule to be something like, make a subinterface on the 2nd router with that IP, mark it as 'ip nat outside', then NAT from to on the 2nd router? So you basically nat to hop to the first router, then nat to hop to the webserver. Is my logic off here?

Which router are you going to use for VPN? ADSL or LAN?

If you don't want a default route on LAN router you can create a more specific static route

ip route and then use acl to permit or block other ip addresses

Getting Started

Find answers to your questions by entering keywords or phrases in the Search bar above. New here? Use these resources to familiarize yourself with the community: