Strange behavior allowing routing only 1 direction across NAT.
Posted on 2008-10-07
Okay, so the idea is pretty simple. There are two subnets, let's say 192.168.0.0/24 and 10.0.0.0/24. They are connected via a Cisco 3600. There are two physical interfaces used and a NAT running. The 192 NIC is inside and the 10 NIC is outside.
ip nat inside source list 1 interface FastEthernet0/1 overload
access-list 1 permit 192.168.0.0 0.0.0.255
access-list 1 permit 10.0.0.0 0.0.0.255
That really is it. The permit for 10.0.0.0 actually doesn't do anything either, that I can tell.
Now, let's say I have a computer and I set the IP to 192.168.0.100. It can ping 192, 10, or anything else without problems. If I change the computer's IP to 10.0.0.100, various things happen. I have tried on 3 computers.
#1 was a vista box and it couldn't ping the 192 network at all, but it could ping everything else.
#2 was an XP box and it can ping the 192 network, but, for example, cannot connect on port 25 or 443 to the Exchange server on the 192 network.
#3 was a virtual server running 2k3 and it cannot ping anything on the 192 at all.
Does anyone have any idea why this is happening? I can't figure out why it is allowing traffic one direction and I am getting problems (and different ones) trying to go the other way.
Oh, if anyone cares, IOS is c3640-js-m version 12.4(7g).