Cisco IOS NAT Virtual Interface

Up until recently, I’ve had ADSL at home for some years. For the last year or so, I’ve used a Cisco 1812 as my router (the ISP-router was put into bridge-mode). A few weeks ago, when I got a 10/10Mbps fiber-connection, it suddenly became more relevant to host some services at home (why pay for web-hosting, when you can host it home, for free?). As a result of this, I stumbled upon a “problem” that annoyed me a bit; loopback-support – the ability to reach your services using your external IP, and hence applying port-forwards (this way you could use ssh externalip -p "some odd port number" regardless if you are home or not). This is quite useful if you move between different networks a lot (e.g. using a laptop – which was the case for me). This feature is known as tromboning, or hairpinning, and is something that often works on cheap routers you get from your ISP. So, why shouldn’t this work on a Cisco-device?

Why can’t you just use the normal ip nat inside and ip nat outside clauses? Well, if I’m not entirely mistaken (feel free to correct me if I’m wrong), if a packet, destined for an IP-address on a interface with ip nat outside, is received on a interface with ip nat inside, the packet is just dropped.

After a bit of intense Googling, reading page up and page down, it seemed that this feature wasn’t natively supported – at least for a while ago. There where different “hacks”, which involved PBR (Policy-based routing) using a Loopback-interface, and some other trickery (more info). After some more reading, this “hack” would only work if you have several static, and public, IP-addresses (I read somewhere that it might be possible with only one public IP-address, using VRF’s and whatnot, but this was way above my skill-level at the time). This is often not the case for most home-users, and as such, these “hacks” where a no-go for me.

I also came across NVI (NAT Virtual Interface), but Cisco’s tutorials also pointed in the direction that it was required to have more than one static, and public, IP-address. I decided to try anyways, knowing very little about the subject, and soon found out that is was quite easy.

So, let’s get to the configuring. NVI was introduced in IOS 12.3(14)T, so you’ll need this, or newer, for it to work.

The setup is quite basic:

R1(config)#interface fastEthernet 0
R1(config-if)#ip address dhcp
R1(config-if)#no shutdown
R1(config-if)#ip nat enable
R1(config-if)#interface fastEthernet 1
R1(config-if)#ip address 192.168.0.1 255.255.255.0
R1(config-if)#no shutdown
R1(config-if)#ip nat enable
R1(config-if)#exit
R1(config)#access-list 1 permit 192.168.0.0 0.0.0.255
R1(config)#ip nat source list 1 interface FastEthernet0 overload

And that’s it. To verify;

R1#show ip nat nvi translations
Pro Source global         Source local          Destin  local         Destin  global
tcp <fa0-address>:49525    192.168.0.26:49525    17.148.16.46:993      17.148.16.46:993
tcp <fa0-address>:61251    192.168.0.33:61251    173.225.132.24:443    173.225.132.24:443
tcp <fa0-address>:61252    192.168.0.33:61252    173.225.132.36:443    173.225.132.36:443
tcp <fa0-address>:61253    192.168.0.33:61253    173.225.132.11:443    173.225.132.11:443
tcp <fa0-address>:61254    192.168.0.33:61254    173.225.132.25:443    173.225.132.25:443
tcp <fa0-address>:61255    192.168.0.33:61255    173.225.132.29:443    173.225.132.29:443
 --More--

Please note that if you cannot get it to work, you can try applying the following command to all NAT-enabled interfaces (thanks to Tim for pointing this out!);

 no ip redirects

If you, like me, already had ip nat inside/outside applied before using NVI, you’d have to remove some old settings before entering the commands above. The first thing you’ll do, is to remove the ip nat inside/outside;

R1(config)#interface fastEthernet 0
R1(config-if)#no ip nat outside
R1(config-if)#interface fastEthernet 1
R1(config-if)#no ip nat inside

Then you’ll need to clear the NAT-translation table (since static NAT-entries cannot be removed if in use), and then remove old, static NAT-entries. Finally you’ll add the static NAT-entries again, but with a different syntax.

R1#clear ip nat translation *
R1#show run | i static
ip nat inside source static tcp 192.168.0.2 80 interface FastEthernet0 80
R1#conf t
R1(config)#no ip nat inside source static tcp 192.168.0.2 80 interface FastEthernet0 80
R1(config)#ip nat source static tcp 192.168.0.2 80 interface FastEthernet0 80

So, the syntax-change is basically to remove the inside/outside restriction. If you have loads of old static NAT-entries, you could copy-paste them to a text-editor, and replace ip nat with no ip nat, and then copy them into the router. Likewise, you could use the replace-function to change the syntax; replace ip nat {inside|outside} with ip nat.

Oh, as a footnote; I’m aware that this could, in some degree, be solved by using split-horizon DNS – however, this would not work if the external ports that are forwarded, differs from the internal one (e.g. if port 4321 on your external address is forwarded to port 22 on an internal address, using PAT).

Update #1: Tim pointed out that he needed to apply no ip redirects to get all of the above working. The post has been changed to reflect this. Thanks, Tim!