Static NAT

One-to-one

Static NAT always maps the same inside local address to the same inside global address. Because the mapping is permanent, outside hosts can start connections to it: that's how you publish a server. Three steps:

1. Mark the interfaces: ip nat inside on the LAN side, ip nat outside on the internet side.
2. Create the mapping: ip nat inside source static 192.168.1.100 203.0.113.5.
3. Check it: show ip nat translations.

In NetLab

▶ R1
R1>enable
R1#configure terminal
Enter configuration commands, one per line.  End with CNTL/Z.
R1(config)#interface g0/0
R1(config-if)#ip nat inside
R1(config-if)#interface g0/1
R1(config-if)#ip nat outside
R1(config-if)#exit
R1(config)#ip nat inside source static 192.168.1.100 203.0.113.5
R1(config)#end
*Mar  1 00:00:09.000: %SYS-5-CONFIG_I: Configured from console by console
▶ REMOTE
student@REMOTE:~$ curl http://203.0.113.5
<html><body><h1>Welcome to SRV</h1></body></html>
▶ R1
R1#show ip nat translations
Pro  Inside global         Inside local          Outside local         Outside global
---  203.0.113.5           192.168.1.100         ---                   ---
tcp  203.0.113.5:80        192.168.1.100:80      198.51.100.20:49162   198.51.100.20:49162

REMOTE connects to 203.0.113.5; R1 translates the destination to 192.168.1.100 and the reply's source back to 203.0.113.5. The --- line is the static mapping itself; the tcp line is this one connection.

Tip: Port forwarding is static NAT for one port: ip nat inside source static tcp 192.168.1.100 80 203.0.113.2 8080 sends connections to the router's own address on port 8080 to the server's port 80.