07-08-2012 04:01 PM - edited 03-07-2019 07:39 AM
Im struggling to get traffic from inside the lan to hit the router, and be redirected when hitting that external IP address just like outside clients would.
if my site was foobar.dyndns.org:
foobar.dyndns.org:443 - 192.168.1.2:443
foobar.dyndns.org:8080 - 192.168.1.3:80
foobar.dydnds.org:3389 - 192.168.1.4: 3389
On the outside, that works as expected. but from inside, connections cannot be established.
My setup:
cisco 1721 router (router on a stick config)
Cisco 2950 switch
cisco 1241 AP
1721 has 3 sub interfaces configured:
0.2 - to the internet (vlan 2)
0.3 - to the wired network (192.168.1.0/24) (vlan 3)
0.4 - to the wireless network (192.168.2.0/24) (vlan 4)
currently I have a blanket allow for nat traversing from any inside source to fa0.2 (overload) to allow outbound traffic to the internet
then I have a few specific nat statements for port address translation to various hosts on vlan 3
my external address is dynamic, so Im mapping the wan interface on the switch for all of my translations.
This works great when Im outside the network connecting to the hosted services via a dyanmic DNS hostname. However when I reference that host from inside the network, the DNS lookup works fine, but the traffic is not routed to the appropriate internal resource. Since I have but 1 external internet address and the port translations are spanned across multiple hosts internally, rewriting DNS for that zone is not an option. Im not sure how to write the nat statment(s) needed to allow for this internal traffic to hit the router and be translated appropriately coming back in. My cheapo E2000 and WRT54gl routers handled this without any configuration, so Im sure its doable, I just need a hint to move in the right direction.
Thanks!
Additionally, if this type of communication has a proper name, can someone educate me on it? I was struggling with fruitless searches before I finally decided to break down and ask.
Solved! Go to Solution.
07-14-2012 02:41 PM
Sean,
This is called nat loopback or nat hairpin.
You may be abl to use something like this depending on your config:
ip nat inside source static 192.168.1.50 203.111.177.242
Best,
David
07-10-2012 07:36 AM
Hello,
Check out the below link for nat configuration
http://www.cisco.com/en/US/tech/tk648/tk361/technologies_tech_note09186a0080094e77.shtml
Hope to Help !!
Ganesh
07-14-2012 12:12 PM
Thanks for the reply,
Unfortunately I wasn't able to get any new helpful information from that page. I segmented my services and workstations to different vlans, however, I still cant translate. Is it not possible to do pat on the internal LAN on this device? I'm pretty much fresh out of ideas. At this point, I can't offer a unified service access experience for my users on the Cisco equipment I have. I was considering an Asa 5505, but it looks like it will be too expensive to obtain the appropriate licensing to allow more than one vlan on the device, on top of the cost of the device.... If anyone has any suggestions, I'm all ears...
Sent from Cisco Technical Support iPad App
07-14-2012 02:41 PM
Sean,
This is called nat loopback or nat hairpin.
You may be abl to use something like this depending on your config:
ip nat inside source static 192.168.1.50 203.111.177.242
Best,
David
07-18-2012 11:40 PM
That worked really well for most of my services, thank you!!!
I have 2 other published services that are on a different system, since I'm translating the entire address to one full address, does this make my need impossible itch out a firewall or Asa?
-edit-
It looks like the new nat statement had one unfortunate side effect, in that it ignores the previous statements for outside connections. As a current work around, I'm going to set up a reverse proxy for the web services on other boxes. The statement is so similar to the pat statements, I don't follow,why they don't work but this one does...
-edit-
My mistake, works fine in and out.
Sent from Cisco Technical Support iPad App
Discover and save your favorite ideas. Come back to expert answers, step-by-step guides, recent topics, and more.
New here? Get started with these tips. How to use Community New member guide