NATing an Xbox 360 (port forward)

[Steven Tolzmann]

I am trying to setup my NAT for 1 Xbox 360, so when Port 3074 (UDP) is requested on my WAN IP, it will direct traffic to my Xbox 360 on UDP 3074. So basically a port forward, WAN_IP:3074UDP >> 10.10.0.51:3074UDP

This is on a 2600 series router.

xbox 360 network config:

ip address: 10.10.0.51 (static)

default gateway: 10.10.0.1

cisco ios config:

int fa0/0

ip address dhcp   <<<COMCAST CABLE

ip nat outside

no shutdown

int fa0/1

ip address 10.10.0.1 255.255.255.0   <<< LAN GATEWAY

ip nat inside

no shutdown

ip nat inside source list 1 interface FastEthernet0/0 overload  << this works fine, my internal devices all translate to my WAN address

access-list 1 permit 10.10.0.1 0.0.0.254

ip nat inside source static udp inside_local_ip 3074 inside_global_ip 3074

^^^ This is where I am running into trouble, from what I understand I set the local ip as 10.10.0.51, and the global IP would be my outside IP on fa0/0. However since I use DHCP on fa0/0 I don't want to manually enter the IP every time it changes.

Anyone able to shed some light on the best way to go about this?

[Jon Marshall]

Steven

ip nat inside source static udp inside_local_ip 3074 interface fa0/0 3074

Jon

[Steven Tolzmann]

xxxxx(config)#ip nat inside source static 10.10.0.51 3074 interface fa0/0 3074
                                                                                                        ^
% Invalid input detected at '^' marker.

It won't accept an interface

[Jon Marshall]

sptmaster wrote:
xxxxx(config)#ip nat inside source static 10.10.0.51 3074 interface fa0/0 3074
                                                                                                        ^
% Invalid input detected at '^' marker.
It won't accept an interface 

Steven

You missed out the "udp" bit in the statement. Could you retry with that.

If it still doesn't work which IOS are you running ? I tested with 12.4 and it worked fine.

Jon

[Steven Tolzmann]

Woops, think i copy pasted it wrong, still didn't work though.

xxxxxxx(config)#ip nat inside source static udp 10.10.0.51 3074 interface fa0/0 3074
                                                                                                                     ^
% Invalid input detected at '^' marker.

IOS:

Version 12.2(34a)

rest of sh ver:

cisco 2621 (MPC860) processor (revision 0x600) with 61440K/4096K bytes of memory.
Processor board ID JAD053206UV (3398476904)
M860 processor: part number 0, mask 49
Bridging software.
X.25 software, Version 3.0.0.
SuperLAT software (copyright 1990 by Meridian Technology Corp).
TN3270 Emulation software.
2 FastEthernet/IEEE 802.3 interface(s)
32K bytes of non-volatile configuration memory.
16384K bytes of processor board System flash (Read/Write)

[Reza Sharifi]

Steven,

I tried this on 2611 router running IOS 12.2-24a and it works fine

C4#config t
Enter configuration commands, one per line.  End with CNTL/Z.
C4(config)#ip nat inside source static udp 10.10.0.51 3074 interface ethernet 0/0 3074
C4(config)#

What do you see if you do? after interface?

HTH

Reza

[Steven Tolzmann]

I just get an error message after the command with the ^ pointing at the interface argument.

I think a possibility why this might not be working is I'm doing it on packet tracer (has same IOS as my real router though), since I'm getting my configs tested before i load them onto my real router. Although this would be rather odd since I've never had any problems with the packet tracer IOS for testing things out.

I'm going to bust out my serial cable and trial/error on the real thing I guess, I'll post again in a couple days if I don't make any progress.

Thanks for help everyone.

[Mark]

Hello,

I'm having the same problem on my 1841 running 12.3, kids are having problems joining games. Would anyone be willing to check out my config and let me know where I goofed?

I just added these and still no go-

CISCO_1841(config)#ip nat inside source static udp 192.168.100.9 3074 interface FastEthernet0/0 3074
CISCO_1841(config)#ip nat inside source static udp 192.168.100.9 88 interface FastEthernet0/0 88
CISCO_1841(config)#ip nat inside source static udp 192.168.100.9 53 interface FastEthernet0/0 53
CISCO_1841(config)#ip nat inside source static udp 192.168.100.9 80 interface FastEthernet0/0 80
CISCO_1841(config)#ip nat inside source static udp 192.168.100.9 3074 interface FastEthernet0/0 3074
CISCO_1841(config)#ip nat inside source static udp 192.168.100.9 500 interface FastEthernet0/0 500
CISCO_1841(config)#ip nat inside source static udp 192.168.100.9 3544 interface FastEthernet0/0 3544
CISCO_1841(config)#ip nat inside source static udp 192.168.100.9 4500 interface FastEthernet0/0 4500

Here is my config-

 version 12.4
service timestamps debug datetime msec
service timestamps log datetime msec localtime
service password-encryption
!
hostname CISCO_1841
!
boot-start-marker
boot config flash:running-config
boot-end-marker
!
logging buffered 4096 debugging
enable secret 5 $1$NQDK$tuRCWqVxH7tRsZdHSczUJ1
!
aaa new-model
!
!
aaa authentication login default local
aaa authentication login userauthen local
aaa authorization network default local
aaa authorization network groupauthor local
!
aaa session-id common
clock timezone EST -5
clock summer-time EDT recurring
ip cef
!
!
ip auth-proxy max-nodata-conns 3
ip admission max-nodata-conns 3
no ip dhcp use vrf connected
ip dhcp excluded-address 192.168.100.1 192.168.100.25
!
ip dhcp pool DATA
network 192.168.100.0 255.255.255.0
dns-server 75.75.75.75 8.8.8.8
default-router 192.168.100.1
!
ip dhcp pool WIRELESS
network 192.168.103.0 255.255.255.0
dns-server 75.75.75.75 8.8.8.8
default-router 192.168.103.1
!
ip dhcp pool CANON
host 192.168.100.5 255.255.255.0
client-identifier 0100.1e8f.39c0.c4
!
ip dhcp pool MONITOR
host 192.168.100.174 255.255.255.0
client-identifier 0100.2170.476e.10
!
ip dhcp pool VOIP
network 192.168.102.0 255.255.255.0
dns-server 75.75.75.75 8.8.8.8
default-router 192.168.102.1
!
ip dhcp pool SUT
network 192.168.101.0 255.255.255.0
dns-server 75.75.75.75 8.8.8.8
default-router 192.168.101.1
!
ip dhcp pool XBOX
host 192.168.100.9 255.255.255.0
client-identifier 0100.25ae.6666.09
!
!
ip ddns update method no-ip
HTTP
add http://northnet:andrew4597@dynupdate.no-ip.com/nic/update?hostname=northshire.no-ip.biz&myip=76.19.253.160
interval maximum 0 4 0 0
!
!
async-bootp dns-server 8.8.8.8
!
crypto pki trustpoint TP-self-signed-2714623577
enrollment selfsigned
subject-name cn=IOS-Self-Signed-Certificate-2714623577
revocation-check none
rsakeypair TP-self-signed-2714623577
!
!
crypto pki certificate chain TP-self-signed-2714623577
certificate self-signed 01
30820257 308201C0 A0030201 02020101 300D0609 2A864886 F70D0101 04050030
31312F30 2D060355 04031326 494F532D 53656C66 2D536967 6E65642D 43657274
69666963 6174652D 32373134 36323335 3737301E 170D3137 31323038 32313233
33315A17 0D323030 31303130 30303030 305A3031 312F302D 06035504 03132649
4F532D53 656C662D 5369676E 65642D43 65727469 66696361 74652D32 37313436
32333537 3730819F 300D0609 2A864886 F70D0101 01050003 818D0030 81890281
8100D003 AB5C4BD0 A741A8DE 506C4BE6 42A4E2EF DDE6BA34 16D7F2FB 64E4431A
E84361FC 44263E33 35F09285 0A8EC17A BD7C00EF F8F46F48 45D2367A 1755792D
89716DE1 BDD2740C 755B00F3 AC19B443 DE401821 17FB7C00 BE6D30D5 49800FD4
7ADE5072 18BAAB4D 57C3253B F7602BCC 0A3A15A0 57314D35 4B9CF9A8 8CAFFFA9
D3D50203 010001A3 7F307D30 0F060355 1D130101 FF040530 030101FF 302A0603
551D1104 23302182 1F434953 434F5F31 3834312E 68736431 2E76742E 636F6D63
6173742E 6E65742E 301F0603 551D2304 18301680 14F9099F 868D57A5 96AF22C9
BE730271 23E38849 45301D06 03551D0E 04160414 F9099F86 8D57A596 AF22C9BE
73027123 E3884945 300D0609 2A864886 F70D0101 04050003 81810066 E2ED3BE8
11957DE9 BB426E32 FCF211C7 4D38BC83 4424ECDB 4278FE67 94E057B3 8CB84E6B
DA3C08AC 5B0A5E5D D97C5872 888698D9 5A3DBD11 9C816725 FA577F1B 9B0A7E09
7AC5B6A7 EB06F5B9 1DB20D45 A20A15C3 F41906EA D7F9E955 CEFC1573 BDE4A2EE
D2076821 CC77CAE9 A486C477 7680FF37 777C7010 558F50FA E13BC7
quit
username administrator secret 5 $1$ffKd$1jNa1UZmYz8x/wmHWowlh.
username northnet secret 5 $1$ePv7$ohkQUL0maM1RbPOMF/Sxg/
username mchila secret 5 $1$9Qku$fWUZUC68QFEp43q2fMwd31
username admin privilege 15 password 7 0305550F140A36181B504E
username vpn privilege 15 secret 5 $1$eXR.$oGpc7tWWGlf0LwDX6NMag0
!
!
!
!
crypto isakmp policy 1
encr 3des
authentication pre-share
group 2
crypto isakmp client configuration address-pool local VPN
!
crypto isakmp client configuration group vpnclient
key northnetvpn
dns 8.8.8.8
pool VPN
acl 101
!
!
crypto ipsec transform-set myset esp-3des esp-md5-hmac
no crypto ipsec nat-transparency udp-encaps
!
crypto dynamic-map dynmap 10
set transform-set myset
reverse-route
!
!
crypto map clientmap client authentication list userauthen
crypto map clientmap isakmp authorization list groupauthor
crypto map clientmap client configuration address respond
crypto map clientmap 10 ipsec-isakmp dynamic dynmap
!
crypto map intmap client configuration address initiate
!
!
!
interface FastEthernet0/0
ip ddns update hostname northshire.no-ip.biz
ip ddns update no-ip
ip address dhcp
ip nat outside
ip virtual-reassembly
duplex auto
speed auto
no cdp enable
crypto map clientmap
!
interface FastEthernet0/1
no ip address
duplex auto
speed auto
!
interface FastEthernet0/1.100
encapsulation dot1Q 100
ip address 192.168.100.1 255.255.255.0
ip nat inside
ip virtual-reassembly
!
interface FastEthernet0/1.101
encapsulation dot1Q 101
ip address 192.168.101.1 255.255.255.0
ip nat inside
ip virtual-reassembly
!
interface FastEthernet0/1.102
encapsulation dot1Q 102
ip address 192.168.102.1 255.255.255.0
ip nat inside
ip virtual-reassembly
!
interface FastEthernet0/1.103
encapsu ip address 192.168.103.1 255.255.255.0
ip nat inside
ip virtual-reassembly
!
interface Serial0/0/0
no ip address
shutdown
!
ip local pool VPN 10.10.10.10 10.10.10.50
no ip forward-protocol nd
!
no ip http server
ip http authentication local
ip http secure-server
ip http timeout-policy idle 60 life 86400 requests 10000
ip nat inside source list 111 interface FastEthernet0/0 overload
ip nat inside source static udp 192.168.100.9 4500 interface FastEthernet0/0 4500
ip ip nat inside source static tcp 192.168.100.1 22 interface FastEthernet0/0 22
ip nat inside source static esp 192.168.100.1 interface FastEthernet0/0
ip dns server
!
access-list 101 remark Allowed VPN Traffic
access-list 101 permit ip 192.168.100.0 0.0.0.255 10.10.10.0 0.0.0.255
access-list 101 permit ip 192.168.101.0 0.0.0.255 10.10.10.0 0.0.0.255
access-list 101 permit ip 192.168.102.0 0.0.0.255 10.10.10.0 0.0.0.255
access-list 101 permit ip 192.168.103.0 0.0.0.255 10.10.10.0 0.0.0.255
access-list 111 remark NAT and Split Tunnel
access-list 111 deny ip 192.168.100.0 0.0.0.255 10.10.10.0 0.0.0.255
access-list 111 deny ip 192.168.101.0 0.0.0.255 10.10.10.0 0.0.0.255
access-list 111 deny ip 192.168.102.0 0.0.0.255 10.10.10.0 0.0.0.255
access-list 111 deny ip 192.168.103.0 0.0.0.255 10.10.10.0 0.0.0.255
access-list 111 permit ip any any
!
!
control-plane
!
!
line con 0
line aux 0
transport input ssh
line vty 0 4
privilege level 15
transport input telnet ssh
transport output telnet ssh
line vty 5 15
privilege level 15
transport input telnet ssh
transport output telnet ssh
!
scheduler allocate 20000 1000
ntp clock-period 17178994
ntp server 198.144.194.12 prefer
end