Cisco Internet with PAT and NAT Not Working

interface FastEthernet0/0
 description ** Outsaide Connection **
 ip address 98.152.22.154 255.255.255.252
 ip access-group 111 in
!
access-list 111 permit tcp any host 98.152.22.154 eq www

Select allOpen in new window

I cant seem to get any external connectivity at the moment. I cant ping anything external.

The only traffic allowed in is TCP port 80 traffic going to 98.152.22.154.  Period.  Nothing else.
You need to add some permits for other traffic.  Like ICMP echo-replies, and anything coming back from outgoing requests.

For example:
ip access-group 111 permit tcp any any gt 1023 est
ip access-group 111 permit icmp any any echo-reply

Hi Don,

Many thanks for your reply.

Sorry I may have worded it badley. Currently I can't get connectivity from the inside to the outside. I.e no internet access.

Of do I need to modify the all to allow it?

Cheers
TME

Connectivity is a two-way street.

If you are trying to communicate from the inside to a host on the outside, the returning traffic has to be able to get in.

So you need to allow the returning traffic.

Ah.

Excellent. I disnt realise that. I thought if it was sent it would return.

I'll give that a go.  Is there is standard list of what needs to come back? Anywhere?

Cheers
TME

Hi Don,

Thanks for your help again.

for testing i have added:

ip access-group 111 permit tcp any any
ip access-group 111 permit udp any any

Still nothing from the inside to the outside though:(

Any Idea's?

Cheers
SI

Hi Again Don,

Just noticed ... Dont know if this is of any consequence or not ... but .. From a Client for example 10.2.1.99 i can ping 98.152.22.154 but from the route CLI i cannot.

Also i cant ping the Default External Gateway of 98.152.22.153 from either the router or the client?

Cheers Again
TME

Please post the current config.

Hi Don,

It's the same as posted earlier but the access-list 111 is now:-

p access-group 111 permit tcp any any
ip access-group 111 permit udp any any

No ther changes made.

Cheers again
TME

Hi TME,

For one thing, 98.152.22.153 is not pingable from the internet, I have tried from my end. Most likely they are blocking ICMP to this IP. You'll have to coordinate with your ISP on this.

Secondly, having your outside ACL as such:

interface FastEthernet0/0
 ip access-group 111 in
!
access-list 111 permit tcp any any
access-list 111 permit udp any any

Select allOpen in new window

This is very unsecured as this basically means you are allowing all kinds of TCP/UDP traffic incoming. Consider reducing it as Don have suggested.

access-list 111 permit tcp any 98.x.x.x 80
access-list 111 permit icmp any 98.x.x.x echo-reply 
!
ip nat inside source static tcp 10.2.1.101 80 92.x.x.x 80 extendable

Select allOpen in new window

All credit goes to Don, as he already mentioned all of this above.

Hi,

I only did the any any on the ACL for testing purposes.

Unfortunatly i cant get anything from inside to outside still so dont think its the ACL causing the problem.

Cheers
Si

hi All,

Actually this is now working using:-

ip access-list extended IPFW-ACL
 permit tcp any host 10.2.1.101 eq www
 permit tcp any any gt 1023 established
 permit tcp any any eq domain
 permit udp any any eq domain
 permit icmp any any administratively-prohibited
 permit icmp any any echo-reply
 permit icmp any any packet-too-big
 permit icmp any any time-exceeded
 permit icmp any any traceroute
 permit gre any any
 deny   ip any any log
ip access-list extended NAT-ACL
 permit ip 10.2.1.0 0.0.0.255 any
 permit ip 10.2.2.0 0.0.0.255 any
 permit ip 10.2.4.0 0.0.0.255 any
 permit ip 10.2.110.0 0.0.0.255 any
 permit ip 10.2.190.0 0.0.0.255 any
 permit ip 10.2.200.0 0.0.0.255 any

Many Thanks to Don and Ffleisma

Cheers
TME