Lab: NAT and PAT to a simulated internet

Aim and what you need

The aim is to see NAT working from both directions: inside users reaching an outside web server through one shared address, and outside users reaching one inside server through its own public address. The "internet" here is just another router in your simulator, so nothing leaves your lab.

• Packet Tracer or your own lab: R1 (edge router), an ISP router, a switch, two PCs and two servers.
• Addresses from the documentation ranges 203.0.113.0/24 and 198.51.100.0/24, which are reserved for examples and never used on the real internet.

Design

Steps

1. Address all devices. The ISP router needs no routes to your private network: that is the point.
2. On R1, add a default route to the ISP and mark the inside and outside interfaces.
3. Create static NAT for the internal server.
4. Create an access control list (ACL) matching the LAN and enable PAT on the outside interface.

! R1
ip route 0.0.0.0 0.0.0.0 203.0.113.1
interface g0/0
 ip nat inside
interface g0/1
 ip nat outside
exit
ip nat inside source static 192.168.10.50 203.0.113.5
access-list 1 permit 192.168.10.0 0.0.0.255
ip nat inside source list 1 interface g0/1 overload

If your provider gave you a small block, you could instead use a pool with overload. Here the interface address is enough.

Verify

From a PC, browse to http://198.51.100.10 (Desktop, Web Browser) and ping it. From the outside server, browse to http://203.0.113.5. Then read the table on R1. Success means you see dynamic entries with inside local 192.168.10.x and inside global 203.0.113.2 plus port numbers, and a permanent static entry for 192.168.10.50 to 203.0.113.5.

show ip nat translations
show ip nat statistics
clear ip nat translation *
debug ip nat
undebug all

Tip: use debug only in a lab or with great care; on a busy production router it can overload the CPU.

Troubleshooting and clean-up

• No translations appear: ip nat inside and ip nat outside are swapped or missing.
• Some hosts translate, others do not: the ACL does not match their subnet; check the wildcard mask.
• Outside cannot reach the published server: the ISP router must reach 203.0.113.5. It does here because that address is inside its connected /29.
• Ping works but web does not: check the server's HTTP service is on and its gateway is 192.168.10.1.

To clean up, remove the NAT statements with no ip nat inside source ... (you may need to clear translations first) and delete ACL 1. Remember that NAT is not a firewall: it hides addressing, but you still need filtering rules. The ACL lab adds that layer.