NAT: PAT (overload) for an inside LAN

Services & wireless
Intermediate
14 min
4 steps
Cisco IOS-style

Configure inside-source PAT (overload) on R1 so a private LAN reaches the internet behind a single public IP. Then add a static 1:1 mapping for an internal web-server.

Open this lab in your browser →

Free · no install · no account

Scenario

Network Address Translation lets a private network share one or a few public IPs. `` +----- inside (LAN) -----+ +-- outside --+ | 10.0.0.0/24 | | 198.51.100 | | H1 H2 WEB | R1 | ISP/INET | +------------------------+ +-------------+ ` - PAT (overload): many private hosts share one public IP. The router rewrites both the source IP *and* the L4 port; replies are de-multiplexed by remembering each (insideIp, insidePort) → (publicIp, publicPort) binding in the NAT table. - Static NAT (1:1): one private host gets a fixed public IP forever — used for inside-hosted servers that need to be reached from the outside (web servers, mail, …). In Cisco IOS the inside/outside boundary is declared per-interface with ip nat inside / ip nat outside, then the rules go in global config: ip nat inside source list/static …`.

Topology

3 × router, 1 × switch, 1 × internet · Cisco IOS-style

H1 — router
WEB — router
HUB — switch
R1 — router
INET — internet

What you will do

On R1 mark the inside (Gi0/0) and outside (Gi0/1) NAT roles. Without these the rules below are no-ops.
Create a standard ACL (NAT-INSIDE) that matches the LAN (10.0.0.0/24). PAT will use this ACL to decide what to translate.
Wire the ACL to PAT overload on R1's outside interface: ip nat inside source list NAT-INSIDE interface Gi0/1 overload.
Add a static 1:1 mapping for the inside web-server: 10.0.0.50 → 198.51.100.50.

Open this lab in your browser →

NAT: PAT (overload) for an inside LAN

Scenario

Topology

What you will do

More labs on this topic

This lab in other languages