Hi All, I have a small network consisting of 12 workstations and 6 servers, each one of the 6 servers have services that need to be access from outside the LAN.
Our company has two /29 Live Subnets (6 IP Addresses).
In the Interest of security and conservation of IP's, I chose not to simply assign the 6 live IP's to my 6 servers. Instead I have opted into making our cisco router do a little more work.
I have configured a Loopback Interface on our Cisco 2611XM and assigned the live subnet 203.56.246.136/29 to it. I have then used Network Address Translation to forward specific services on these IP's through to our servers VLAN (172.16.1.X/24). Kind of a simple DMZ I guess.
The Workstations use the router for their NAT when accessing the Internet, and all their internal packets (192.168.20.X) are translated to our routers external static IP (203.56.245.33).
All of this is working very well, but I seem to have hit a limitation of this setup that I am hoping someone can help me with.
When an user tries to view our website from outside our network, things work fine, NAT ensures that port 80 on the appropriate IP address is forwarded through to the internal address of our webserver, however, from inside the network if a user wants to browse our website they must enter
http://172.16.1.25 to reach it, if they enter our domain name, they are forwarded to 203.56.246.X, and that address cannot be reached from inside the network.
Is there someway that this configuration can reamin, but some sort of reverse NAT can be implemented to users on our internal network can browse the website and user other services via their live IP's (203.56.246.136), not their real IP's (172.16.1.X)
Below is an exerpt of our router config:
interface Loopback1
ip address 203.56.246.137 255.255.255.248
ip nat outside
!
interface Loopback2
ip address 203.56.246.249 255.255.255.248
ip nat outside
!
interface ATM0/0
no ip address
no ip mroute-cache
no atm ilmi-keepalive
dsl operating-mode auto
hold-queue 224 in
pvc 8/35
encapsulation aal5mux ppp dialer
dialer pool-member 1
!
!
interface FastEthernet0/0
no ip address
speed auto
full-duplex
!
interface FastEthernet0/0.1
encapsulation dot1Q 1 native
ip address 192.168.0.1 255.255.255.0
ip nat inside
!
interface FastEthernet0/0.20
encapsulation dot1Q 20
ip address 192.168.20.1 255.255.255.0
ip nat inside
!
interface FastEthernet0/0.100
encapsulation dot1Q 100
ip address 172.16.1.1 255.255.255.0
ip nat inside
!
interface FastEthernet0/0.150
encapsulation dot1Q 150
ip address 172.16.31.1 255.255.255.0
!
interface FastEthernet0/1
ip address 192.168.10.1 255.255.255.0
no ip mroute-cache
speed auto
full-duplex
!
interface Dialer1
ip address 203.56.245.33 255.255.255.0
ip nat outside
encapsulation ppp
dialer pool 1
dialer-group 1
ppp authentication chap pap callin
ppp chap hostname XXXXXXXXXXXXXXX
ppp chap password XXXXXXXXXXXXXXXXXXXXX
ppp pap sent-username XXXXXXXXXXXXXX password XXXXXXXXXXXX
!
ip route 0.0.0.0 0.0.0.0 Dialer1
!
ip http server
no ip http secure-server
ip nat inside source list 105 interface Dialer1 overload
ip nat inside source static esp 172.16.1.25 interface Dialer1
ip nat inside source static tcp 172.16.1.20 22 203.56.246.138 22 extendable
ip nat inside source static tcp 172.16.1.20 53 203.56.246.138 53 extendable no-payload
ip nat inside source static udp 172.16.1.20 53 203.56.246.138 53 extendable no-payload
ip nat inside source static tcp 172.16.1.40 20 203.56.246.140 20 extendable
ip nat inside source static tcp 172.16.1.40 21 203.56.246.140 21 extendable
ip nat inside source static tcp 172.16.1.40 22 203.56.246.140 22 extendable
ip nat inside source static tcp 172.16.1.40 25 203.56.246.140 25 extendable
ip nat inside source static udp 172.16.1.40 53 203.56.246.140 53 extendable
ip nat inside source static tcp 172.16.1.40 80 203.56.246.140 80 extendable
ip nat inside source static tcp 172.16.1.40 110 203.56.246.140 110 extendable
ip nat inside source static tcp 172.16.1.40 443 203.56.246.140 443 extendable
ip nat inside source static tcp 172.16.1.22 20 203.56.246.141 20 extendable
ip nat inside source static tcp 172.16.1.22 21 203.56.246.141 21 extendable
ip nat inside source static tcp 172.16.1.22 53 203.56.246.141 53 extendable no-payload
ip nat inside source static udp 172.16.1.22 53 203.56.246.141 53 extendable no-payload
ip nat inside source static tcp 172.16.1.22 80 203.56.246.141 80 extendable
ip nat inside source static tcp 172.16.1.22 443 203.56.246.141 443 extendable
ip nat inside source static tcp 172.16.1.22 3389 203.56.246.141 3389 extendable
ip nat inside source static tcp 172.16.1.40 22 203.56.246.142 22 extendable
ip nat inside source static tcp 172.16.1.40 25 203.56.246.142 25 extendable
ip nat inside source static tcp 172.16.1.40 53 203.56.246.142 53 extendable no-payload
ip nat inside source static udp 172.16.1.40 53 203.56.246.142 53 extendable no-payload
ip nat inside source static tcp 172.16.1.40 110 203.56.246.142 110 extendable
ip nat inside source static tcp 172.16.1.25 25 203.56.246.250 25 extendable
ip nat inside source static tcp 172.16.1.25 53 203.56.246.250 53 extendable no-payload
ip nat inside source static udp 172.16.1.25 53 203.56.246.250 53 extendable no-payload
ip nat inside source static tcp 172.16.1.25 80 203.56.246.250 80 extendable
ip nat inside source static tcp 172.16.1.25 110 203.56.246.250 110 extendable
ip nat inside source static tcp 172.16.1.25 443 203.56.246.250 443 extendable
ip nat inside source static tcp 172.16.1.25 1723 203.56.246.250 1723 extendable
ip nat inside source static tcp 172.16.1.25 3389 203.56.246.250 3389 extendable
!
access-list 105 deny ip any 172.16.1.0 0.0.0.255
access-list 105 deny ip any 203.56.246.0 0.0.0.255
access-list 105 deny ip any 192.168.10.0 0.0.0.255
access-list 105 deny ip any 192.168.0.0 0.0.0.255
access-list 105 permit ip any any
dialer-list 1 protocol ip permit
Start Free Trial
