How do you publish an internal web server to the internet when you only have one public IP address?
Show the answer
Say this first
Static PAT, also called port forwarding: map the public address and port to the server's private
address and port. On IOS, ip nat inside source static tcp 192.168.20.20 443 interface GigabitEthernet0/0/0 443 forwards TCP 443 on R1's outside address to the server, while everyone else
keeps sharing that address through PAT. Then permit the traffic to the public address and port, and
test from the outside, not from the LAN.
Go deeper
Configuration
interface GigabitEthernet0/0/0
ip address 203.0.113.2 255.255.255.248
ip nat outside
interface GigabitEthernet0/0/2
ip address 192.168.20.1 255.255.255.0
ip nat inside
!
ip nat inside source static tcp 192.168.20.20 443 interface GigabitEthernet0/0/0 443
ip nat inside source static tcp 192.168.20.30 22 interface GigabitEthernet0/0/0 2222The second line also changes the port: outside users connect to 203.0.113.2 port 2222 and land on SSH port 22 of 192.168.20.30.
R1# show ip nat translations
Pro Inside global Inside local Outside local Outside global
tcp 203.0.113.2:443 192.168.20.20:443 --- ---
tcp 203.0.113.2:2222 192.168.20.30:22 --- ---
tcp 203.0.113.2:443 192.168.20.20:443 198.51.100.77:50112 198.51.100.77:50112
Total number of translations: 3The lines with --- are the static entries. The third line is a live session from an internet
client at 198.51.100.77.
Checklist
- The inbound ACL or firewall permits TCP 443 to 203.0.113.2, the global address.
- The server's default gateway is R1. If replies leave through another router, they are never untranslated and the client drops them.
- The ISP does not filter the port.
- Test from outside. Testing from the LAN hits the hairpin problem.
On Linux
iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 443 -j DNAT --to-destination 192.168.20.20:443
iptables -A FORWARD -i eth0 -d 192.168.20.20 -p tcp --dport 443 -j ACCEPTThey will ask next
It works from the internet but not from inside the office using the public name. Why?
Hairpinning. Inside users reach the public address through an inside interface, where the router does not translate the destination. Split DNS, which gives inside users the private address, is the clean fix.
The server's default gateway is a different router. What happens?
The SYN arrives through R1 and is translated, but the SYN-ACK leaves through the other router with the private source address. The client never matches it to its connection. Fix the gateway, or source-NAT the inbound traffic on R1 so replies have to come back to it.
Traps
- Testing from inside the LAN and concluding the forward is broken.