Still languishing in NATland!

[PilotMike]

Hey all.

I'm still having some issues getting routing through PAT working the same as my old router.

I have one external IP and am running 10-net internally. I have a local web server with URLs DNSed to the external IP. I'd like to be able to access them through their DNS names instead of the server's local 10-net address. I'm fairly sure it's a routing issue. When I attempt to access this server's URLs from a 10-net machine, I get connection refused. When I enable the http server on the Cisco, any of the URLs I use for my websites result in the Cisco router's auth page for it's internal http server. So it doesn't seem that the router knows how to route requests from 10-net back to the 10-net when the destination IP is the external interface IP.

For example, the web site URL (say,

http://www.mysite.com),

is being run on 10.10.1.6, and is DNS'ed to 1.2.3.4. From outside the router, people have no problem accessing

http://www.mysite.com

or any of the other services I export. But from an internal 10-net machine, connections to

http://www.mysite.com

are refused. Of course, I can connect directly to the internal machine using it's internal address (e.g. 10.10.1.6/mysite/index.html), but then I run into other problems with links being broken and whatnot. Besides, I'd just like it to work the way I'm used to it working.

My last router did some magic to allow requests for services on the external IP address to correctly get routed back in and to the local servers. What I'm looking for is how to accomplish that on the router. Any input would be greatly appreciated!

Router: c1605-R
IOS: 12.2

Config:

ip subnet-zero
no ip domain-lookup
!
!
interface Ethernet0
description ***** internet connection through ISP *****
ip address 66.92.251.203 255.255.255.0
ip access-group 105 in
ip nat outside
!
interface Ethernet1
description ***** local non-routable network *****
ip address 10.10.1.1 255.255.255.0
ip nat inside
!
router rip
network 10.0.0.0
!
ip nat inside source list 1 interface Ethernet0 overload
ip nat inside source static tcp 10.10.1.6 80 66.92.251.203 80 extendable
[snipped other services...]
ip classless
ip route 0.0.0.0 0.0.0.0 66.92.251.1
no ip http server
!
logging trap alerts
logging 10.10.1.6
access-list 1 permit 10.10.1.0 0.0.0.255
access-list 101 permit esp any any
access-list 101 permit udp any any eq isakmp
access-list 101 permit udp any any eq 10000
access-list 101 permit tcp any any eq 1723
access-list 101 permit gre any any
access-list 105 deny ip host 69.10.205.115 any
access-list 105 permit ip any any
dialer-list 1 protocol ip permit
dialer-list 1 protocol ipx permit
snmp-server community public RO
snmp-server enable traps tty
!
[snipped console stuff]
!
end

sankuberrymuch.
-mikec-

 

[SQL2KDBA69]

it look like it working when you use this :

http://66.92.251.203/

 

[PilotMike]

Thanks, sql.

Yes, as mentioned, access from *outside* the LAN works fine to the external IP. It's trying to get to that IP address from *inside* the LAN that breaks.

 

[SQL2KDBA69]

So your not able to access the website from inside using the external ip address?

 

[SQL2KDBA69]

so if u do a "nslookup

http://www.mywebsite.com"

from inside it return the external ip of your router.

 

[PilotMike]

Hey SQL...

Yes in both cases. DNS resolution is correct from inside, and no, I cannot connect from inside using the external IP address. However, pings to the external IP from inside do return okay.

Traceroutes to the external IP of return 1 hop showing the internal interface as the only hop.

 

[SQL2KDBA69]

I had that same problem. but i had an internal dns server for my domain that was forwarded out to an external dns server but on the internal dns server i put in a another domain and alias for example. my company domain is mydomain.com. so i added another forward lookup zone of mysite.com then added a host of webserver with the ip address of 10.0.0.1 then create an alias of

http://www that

pionts to the same ip. so when my internal users type in

http://www.mysite.com

into there browsers it took them to 10.0.0.1 and not the external ip of the router. right now on my home network i cant access any of my server using the external ip of my router from behind the router.

 

[PilotMike]

Thanks for the input, SQL.

I believe KiscoKid also made that recommendation. However, I'm keen on making it work the same as my Netopia router had been doing, which was to allow me to use the external IP address successfully from inside. Seeing that the Netopia was able to do it, I can't see any reason why I can't make the Cisco do the same. It would sure beat running a whole other zone just for internal DNS, which I'd rather not do.

So the search still continues.

 

[SQL2KDBA69]

Well good luck pilot. I tried to get that to work with a 1720 last year and after searching for a month to try and get a router to do a NAT traslation going out on an ip and returing on the same ip. i ended up running it like i explained aboved.

 

[PilotMike]

AHA!

I think I found the solution...
I'll post again after I try deploying it.