cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
1613
Views
0
Helpful
4
Replies

Question on Routing out from the lan and back in.

shinkamui
Level 1
Level 1

Im struggling to get traffic from inside the lan to hit the router, and be redirected when hitting that external IP address just like outside clients would. 

if my site was foobar.dyndns.org:

foobar.dyndns.org:443 - 192.168.1.2:443

foobar.dyndns.org:8080 - 192.168.1.3:80

foobar.dydnds.org:3389 - 192.168.1.4: 3389

On the outside, that works as expected.  but from inside, connections cannot be established.

My setup:

cisco 1721 router (router on a stick config)

Cisco 2950 switch

cisco 1241 AP

1721 has 3 sub interfaces configured:

0.2 - to the internet (vlan 2)

0.3 - to the wired network (192.168.1.0/24) (vlan 3)

0.4 - to the wireless network (192.168.2.0/24) (vlan 4)

currently I have a blanket allow for nat traversing from any inside source to fa0.2 (overload) to allow outbound traffic to the internet

then I have a few specific nat statements for port address translation to various hosts on vlan 3

my external address is dynamic, so Im mapping the wan interface on the switch for all of my translations.

This works great when Im outside the network connecting to the hosted services via a dyanmic DNS hostname.  However when I reference that host from inside the network, the DNS lookup works fine, but the traffic is not routed to the appropriate internal resource.  Since I have but 1 external internet address and the port translations are spanned across multiple hosts internally, rewriting DNS for that zone is not an option.  Im not sure how to write the nat statment(s) needed to allow for this internal traffic to hit the router and be translated appropriately coming back in.  My cheapo E2000 and WRT54gl routers handled this without any configuration, so Im sure its doable, I just need a hint to move in the right direction. 

Thanks!

Additionally, if this type of communication has a proper name, can someone educate me on it?  I was struggling with fruitless searches before I finally decided to break down and ask. 

1 Accepted Solution

Accepted Solutions

Sean,

This is called nat loopback or nat hairpin.

You may be abl to use something like this depending on your config:

ip nat inside source static 192.168.1.50 203.111.177.242

Best,

David

View solution in original post

4 Replies 4

Ganesh Hariharan
VIP Alumni
VIP Alumni

Hello,

Check out the below link for nat configuration

http://www.cisco.com/en/US/tech/tk648/tk361/technologies_tech_note09186a0080094e77.shtml

Hope to Help !!

Ganesh

Thanks for the reply,

Unfortunately I wasn't able to get any new helpful information from that page. I segmented my services and workstations to different vlans, however, I still cant translate. Is it not possible to do pat on the internal LAN on this device? I'm pretty much fresh out of ideas. At this point, I can't offer a unified service access experience for my users on the Cisco equipment I have. I was considering an Asa 5505, but it looks like it will be too expensive to obtain the appropriate licensing to allow more than one vlan on the device, on top of the cost of the device.... If anyone has any suggestions, I'm all ears...

Sent from Cisco Technical Support iPad App

Sean,

This is called nat loopback or nat hairpin.

You may be abl to use something like this depending on your config:

ip nat inside source static 192.168.1.50 203.111.177.242

Best,

David

That worked really well for most of my services, thank you!!!

I have 2 other published services that are on a different system, since I'm translating the entire address to one full address, does this make my need impossible itch out a firewall or Asa?

-edit-

It looks like the new nat statement had one unfortunate side effect, in that it ignores the previous statements for outside connections. As a current work around, I'm going to set up a reverse proxy for the web services on other boxes. The statement is so similar to the pat statements, I don't follow,why they don't work but this one does...

-edit-

My mistake, works fine in and out.

Sent from Cisco Technical Support iPad App

Review Cisco Networking for a $25 gift card