Can anyone check this for me, nat overload, static and default routes, dhcp

VA has DHCP on fa0/0 and will have last good address for the gateway and will reserve 20 IP's for admin devices.
VA fa0/1 will be using static IP addressing and will be using the last good address as the default gateway address.
Serial links will use the 50.75.120.0/30 network on all serials.
Default route set to main via VAs next hop.
VA will be using NAT overload to Main via local interface.
VA
Fa0/0= 172.16.81.254
Fa0/1=172.16.82.126
S0/0/0=50.75.120.130
Main s0/0/1= 50.75.120.129 with a clock rate of 128kbps
Building configuration...
Current configuration : 1376 bytes
version 12.4
no service timestamps log datetime msec
no service timestamps debug datetime msec
no service password-encryption
hostname VA
enable secret 5 $1$mERr$3nisV1NYMTmTN5PhTMBC2/
enable password insurance
ip dhcp excluded-address 172.16.81.235 172.16.81.254
ip dhcp pool VA-dhcp
network 172.16.80.0 255.255.254.0
default-router 172.16.81.254
spanning-tree mode pvst
interface FastEthernet0/0
ip address 172.16.81.254 255.255.254.0
ip nat inside
duplex auto
speed auto
interface FastEthernet0/1
ip address 172.16.82.126 255.255.255.128
ip nat inside
duplex auto
speed auto
interface Serial0/0/0
ip address 50.75.100.130 255.255.255.252
ip nat outside
interface Serial0/0/1
no ip address
shutdown
interface Vlan1
no ip address
shutdown
ip nat inside source list 1 interface Serial0/0/0 overload
ip nat inside source list 2 interface Serial0/0/0 overload
ip classless
ip route 0.0.0.0 0.0.0.0 Serial0/0/1
ip route 50.74.100.128 255.255.255.252 50.74.100.130
access-list 1 permit 172.16.0.0 0.0.255.255
access-list 2 permit 172.16.0.0 0.0.255.255
banner motd ^C
Restricted access to all unauthorized users, proceed at your will. Unauthorized users will be prosecuted to the extend of the law. ^C
line con 0
password shots
login
line aux 0
line vty 0 4
password xrays
login
end
VA(config)#
A network beginner, thank you in advance :))
Sent from Cisco Technical Support iPhone App

Reyna,
I can see a couple of issues
Your static routes:-
ip route 0.0.0.0 0.0.0.0 Serial0/0/1
ip route 50.74.100.128 255.255.255.252 50.74.100.130
Ser 0/0/1 is shut and has no ip addressing.
The route to 50.74.100.128 has no way to reach the next hop 50.74.100.130
Your NAT translations are both the same therfore only one is effective.
Just tidy up a little:-
The only static route you need is a default route:-
ip route 0.0.0.0 0.0.0.0 50.75.100.129
The NAT only requires one list and trans pointing out the outside interface
ip nat inside source list 1 interface Serial0/0/1 overload
access-list 1 permit 172.16.0.0 0.0.255.255
Regards,
Alex.
Please rate useful posts.

Similar Messages

Iptables configuration.. can anyone improve this for me?

mostly put together using quicktables... problem i am having is weird. In order to use IE/MSN messenger i need to have squid running... but then i can disable squid and it keeps working fine.. very strange.. I would like to run without using squid perferably. Strange thing is Firefox works fine all the time... any hints / suggestions??
# set a few variables
echo ""
echo " setting global variables"
echo ""
export PATH=/bin:/sbin:/usr/bin:/usr/sbin:/usr/local/bin:/usr/local/sbin
iptables="/usr/sbin/iptables"
EXT_IP=`/sbin/ifconfig eth0 | grep "inet addr" | cut -d : -f 2 | cut -d " " -f 1`; export EXT_IP
INT_IP=`/sbin/ifconfig eth1 | grep "inet addr" | cut -d : -f 2 | cut -d " " -f 1`; export INT_IP
# adjust /proc
echo " applying general security settings to /proc filesystem"
echo ""
if [ -e /proc/sys/net/ipv4/tcp_syncookies ]; then echo 1 > /proc/sys/net/ipv4/tcp_syncookies; fi
if [ -e /proc/sys/net/ipv4/conf/all/rp_filter ]; then echo 1 > /proc/sys/net/ipv4/conf/all/rp_filter; fi
if [ -e /proc/sys/net/ipv4/ip_forward ]; then echo 1 > /proc/sys/net/ipv4/ip_forward; fi
# load some modules
if [ -e /lib/modules/`uname -r`/kernel/net/ipv4/netfilter/ip_nat_irc.o ]; then modprobe ip_nat_irc; fi
if [ -e /lib/modules/`uname -r`/kernel/net/ipv4/netfilter/ip_conntrack_irc.o ]; then modprobe ip_conntrack_irc; fi
if [ -e /lib/modules/`uname -r`/kernel/net/ipv4/netfilter/ip_conntrack_ftp.o ]; then modprobe ip_conntrack_ftp; fi
if [ -e /lib/modules/`uname -r`/kernel/net/ipv4/netfilter/ip_nat_ftp.o ]; then modprobe ip_nat_ftp; fi
# flush any existing chains and set default policies
$iptables -F INPUT
$iptables -F OUTPUT
$iptables -P INPUT DROP
$iptables -P OUTPUT ACCEPT
# setup nat
echo " applying nat rules"
echo ""
$iptables -F FORWARD
$iptables -F -t nat
$iptables -P FORWARD DROP
$iptables -A FORWARD -i eth1 -j ACCEPT
$iptables -A INPUT -i eth1 -j ACCEPT
$iptables -A OUTPUT -o eth1 -j ACCEPT
$iptables -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT
$iptables -t nat -A POSTROUTING -s 192.168.1.0/24 -o eth0 -j SNAT --to-source $EXT_IP
# allow all packets on the loopback interface
$iptables -A INPUT -i lo -j ACCEPT
$iptables -A OUTPUT -o lo -j ACCEPT
# allow established and related packets back in
$iptables -A INPUT -i eth0 -m state --state ESTABLISHED,RELATED -j ACCEPT
# icmp
echo " applying icmp rules"
echo ""
$iptables -A OUTPUT -p icmp -m state --state NEW -j ACCEPT
$iptables -A INPUT -p icmp -m state --state ESTABLISHED,RELATED -j ACCEPT
$iptables -A INPUT -p icmp --icmp-type echo-request -i eth0 -j DROP
# apply icmp type match blocking
echo " applying icmp type match blocking"
echo ""
$iptables -I INPUT -p icmp --icmp-type redirect -j DROP
$iptables -I INPUT -p icmp --icmp-type router-advertisement -j DROP
$iptables -I INPUT -p icmp --icmp-type router-solicitation -j DROP
$iptables -I INPUT -p icmp --icmp-type address-mask-request -j DROP
$iptables -I INPUT -p icmp --icmp-type address-mask-reply -j DROP
# open and forward ports to the internal machine(s)
echo " applying port forwarding rules"
echo ""
$iptables -t nat -A PREROUTING -i eth0 -p tcp -d $EXT_IP --dport 80 -j DNAT --to-destination 192.168.1.120:80
$iptables -t nat -A PREROUTING -i eth0 -p tcp -d $EXT_IP --dport 22 -j DNAT --to-destination 192.168.1.120:22
$iptables -t nat -A PREROUTING -i eth0 -p tcp -d $EXT_IP --dport 8080 -j DNAT --to-destination 192.168.1.120:22
$iptables -t nat -A PREROUTING -i eth0 -p udp -d $EXT_IP --dport 53 -j DNAT --to-destination 192.168.1.120:53
$iptables -A FORWARD -i eth0 -p tcp --dport 80 -j ACCEPT
$iptables -A FORWARD -i eth0 -p tcp --dport 22 -j ACCEPT
$iptables -A FORWARD -i eth0 -p udp --dport 53 -j ACCEPT
echo " applying bittorrent forwarding rules"
echo ""
## atlantis bittorrent ###
$iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 6881:6999 -j DNAT --to-destination 192.168.1.150
$iptables -A FORWARD -p tcp -d 192.168.1.150 --dport 6881:6999 -j ACCEPT
$iptables -t nat -A PREROUTING -i eth0 -p udp --dport 6881 -j DNAT --to-destination 192.168.1.150
$iptables -A FORWARD -p udp -d 192.168.1.150 --dport 6881 -j ACCEPT
echo " applying World of Warcraft rules"
echo ""
## atlantis blizzard ##
$iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 3724 -j DNAT --to-destination 192.168.1.150:3724
$iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 6112 -j DNAT --to-destination 192.168.1.150:6112
$iptables -A FORWARD -p tcp -d 192.168.1.150 --dport 3724 -j ACCEPT
$iptables -A FORWARD -p tcp -d 192.168.1.150 --dport 6112 -j ACCEPT
# drop all other packets
echo " applying default drop policies"
echo ""
$iptables -A INPUT -i eth0 -p tcp --dport 0:65535 -j DROP
$iptables -A INPUT -i eth0 -p udp --dport 0:65535 -j DROP
echo "### quicktables is loaded ###"
echo ""
also, if anyone can provide insite.. I would like to be able to log iptables to syslog-ng.. any suggestions on this? right now i cant figure out where its logging... if it is..?!
Thanks

phrakture wrote:
cactus wrote:I'm at work right now, so I can't really devote a lot of time to this...i will check back when i get home.
in the meantime, here is my iptables firewall setup. Maybe you can divine some useful knowledge out of it.
iptables.txt
Woah... is your box directly wired to the internet? I just rely on my router to do all this stuff... now, if it was an OpenWrt router, then I'd have something like this...
well this is a secured linux box doing the router work.. so yes it is open to the world.

Please can anyone test this for me? V200 and Repeat Folder play m

Hi
Does anyone here use the play mode called Repeat Folder?
I have selected this play mode and it works fine, but how do you
then change/skip to another folder?
If I try then the unit gets confused and goes from
my folder called DireStraits of 2 to DireStraits 2of2
instead of to U2 2 of 2. Sometimes I can get it to skip
to another folder by scrolling in the other direction but
basically it does not allow me to skip to another folder.
So, what I have to do is change to Normal mode say,
then skip to another folder (which works just fine) and
then turn the play mode back Repeat Folder.
I think this is a buglet?
Can anyone else confirm this behaviour or confirm that they
get normal behaviour once the play mode is set to Repeat Folder.
Thanks in advanceMessage Edited by will77 on 02-02-2005 0:47 AMMessage Edited by will77 on 02-07-2005 06:44 PM

elmulti wrote:
Hi will77,Can you describe what happens if you are in "repeat-folder" mode and select "skip folder" and then scroll to the left or right?
Thanks a lot. Yes. if I scroll right then it goes to the next folder (sometimes) or
jumps a folder or misses one or goes nowhere sometimes, and if I select the folder
it does go to, then it show the track name, but I cannot play it, hitting play
pause play does nothing. If I scroll to the left then I sometimes can get to the folders
it does not show when I scroll right, but again, if I select the folder presented to me
the track will not play. Also I think sometimes it gets confused and does not know whether
to scroll along folder by folder or scroll along track by track within a folder.
Any ideas?
Any MuVo V200 users out there then?
Thanks in advance.

Can anyone answer this for me!!!!

I live in a some what country area and have been for 7 yrs. I currently have phone and tv service through Verizon. But they do not have any internet available where i live. What i do not understand is that i keep getting offers in the mail about their internet service and how it works, but when I call them they tell me a date of when it might be there. They told me 5 yr ago that not just the DSL would be available to me but also the fois internet would be to in just about a year and a half. Well I can honestly say neither is! When I call them they tell me a date and when i call them back after the date they tell me when it will be available they tell me another one. There are a lot of people where I live that have been living here well over 20 yr+ that have had to use that crappy satellite or slow dial up,that would switch to Verizon in a heart beat! But the HUGE thing that I do not understand is at the end of the street there is a small walk in building that says Verizon, they have told me it is one of the main phone stations in the area, but what funny is it the only one without inernet service! AHHHHHHHHHHHHHHHHHHHHHH Plz can anyone tell me when it might become available

Unfortunately, Larry's right on target. Just because there is a building with Verizon on it, there might not be the dslams installed to provide dsl, also known as Verizon High Speed Internet. It might be just an plain old telephone service.
It's simple economics. If you really live in a country area, there may not be enough potential subscribers to cover the cost of the equipment installation to provide service to you. Probably not what you want to hear. Sorry.

Can Anyone Beat This for Terrible Service

Verizon should be ashamed of itself. I started with them in Feb. 2011. I bought a Droid x, which began to reboot. They replaced it with a 'refurbished' model. That rebooted. They replaced with this yet *another* Droid X, which not only rebooted but the screen went black during a call and couldn't be accessed. I had to do a battery pull.
A nice supervisor upgraded me for free to a X2. The first time I used the camcorder, it froze the phone. New supervisor offered me a free Incredible 2, but I didn't want that. He said he'd already ordered it for me but when it came, I was to retun it and let customer service know and they'd switch it with a new X2. When the time came to return it, customer service said that the supervisor was on vacation, no one could contact him and he left no instructions to replace my X2 with a new one. A *month* later, with *no one* able to get in touch with this supervisor, another supervisor tells me the only way to get a new X2 was to extend my contract 6 months and I'd get a gift card to pay for the new X2. Time came to use the gift card and there was still $109 left the card didn't cover. Took a lot of work to get that resolved.
Three weeks go by and the phone is perfect......until 2.3.4 is upgraded and guess what? Yep. The camcorder freezes. Verizon is totally useless and wants me to go back to refurbished models (what did I extend my contract for???) and switches me over to Motorola - in the Philippines, who can't help me. When I finally talk to someone at Motorola, they want me to send them my phone for 2 weeks with no loaner so they can reload the OS.
And Verizon? The rep I spoke to said that Verizon is very well aware that these phones are buggy and the repairs and returns are "making them look so bad that they have a policy change coming so that all returns are to be sent to Motorola instead of them."
I want out of my Verizon contract. I bought my phone and service in good faith and I've not have one phone longer than a month because of all the problems with a phone they *know* and *admit* is buggy. I'm filing complaints with the FCC, the FTC, Verizon, Motorola, the California Attorney General's office, and the BBB. No company should sell devices they know are faulty and yet Verizon is. The rep admitted it. And from all the other people I see on this forum talking about how they've returned their phones numerous times, I am far from the only one.
Shame on you, Verizon! You should do the honest thing and let me out of my contract so I can sign with a company who doesn't sell faulty devices.

I have thanks, I was just answering 06jpearce
This is what I wrote:
Over 9 months and 20 openreach appointments and my broadband is still not fixed. They have tried the "put up with it or we will just say your line is too long and we will stop all broadband service" about 3 times now, but when I point-out my next door neighbour is with TalkTalk, and their BB is fine, and also point out I've had much faster BB for years, they back down.
My speed has gone from 2Mbps to 384Kbps, and every time the phone rings the broadband disconnects.
I am an IT engineer that works from home and about 5 times a day I have to tell my customers that my BB has dropped out and then I explain that I've been waiting 9 months for BT to fix it.
Also I used to set up my customers on BT Broadband but obviously I haven't been doing that for the last 9 months.
I'm sure that the fault is in the old aluminium cable that Openreach don't want to touch (in fact that is what the last engineer told me) .
When you add up the cost of all these engineers calls, and the loss of business from the bad name you are getting, it would have been far cheaper to replace the cable.

PKGBUILD for swiftfox: can someone check this for me?

I just finished my first PKGBUILD, one for swiftfox. Its pre-compiled, so essentially I just dumped all the contents of a tarball into a directory in /opt. If you guys could check it out before I submit it to the aur, I'd really appreciate it.
pkgname=swiftfox
pkgver=1.5.0.3
pkgrel=1
_pkgarch=athlon-xp
pkgdesc="Swiftfox is a prebuilt version of Firefox,optimized for AMD AthlonXP processors"
url="http://www.getswiftfox.com"
license="MPL"
depends=(gtk2 libidl2 mozilla-common nss desktop-file-utils)
makedepends=()
conflicts=()
replaces=()
backup=()
install=('swiftfox.install')
source=(http://www.getswiftfox.com/builds/releases/$pkgname-$pkgver-$_pkgarch.tar.bz2)
md5sums=('d3b810d27f655c4908bcd4c7730d9427')
build() {
cd $startdir/src/
mkdir $startdir/pkg/opt/
cp -r $pkgname $startdir/pkg/opt/$pkgname
and here is the swiftfox.install file
# arg 1: the new package version
pre_install() {
/bin/true
# arg 1: the new package version
post_install() {
ln -s /opt/swiftfox/swiftfox /usr/bin/swiftfox
/bin/true
# arg 1: the new package version
# arg 2: the old package version
pre_upgrade() {
/bin/true
# arg 1: the new package version
# arg 2: the old package version
post_upgrade() {
/bin/true
# arg 1: the old package version
pre_remove() {
/bin/true
# arg 1: the old package version
post_remove() {
rm /usr/bin/swiftfox
/bin/true
op=$1
shift
$op $*
Edit1: added dependencies

Allright, you do have a point about having something in the title, so I've added that, and I've also added to the description. Unless there are any more suggestions, I'll put this into the aur tonight.
pkgname=swiftfox-amd
_pkgname=swiftfox
pkgver=1.5.0.3
pkgrel=1
_pkgarch=athlon-xp
pkgdesc="Swiftfox is a prebuilt version of Firefox,optimized for AMD AthlonXP processors. To install the build for a different architecture, go to getswiftfox.com, find the name they use for your processor, and replace the _pkgarch variable."
url="http://www.getswiftfox.com"
license="MPL"
depends=(gconf libgnomecanvas nss mozilla-common desktop-file-utils libidl2)
makedepends=()
conflicts=()
replaces=()
backup=()
install=
source=(http://www.getswiftfox.com/builds/releases/$_pkgname-$pkgver-$_pkgarch.tar.bz2)
md5sums=('d3b810d27f655c4908bcd4c7730d9427')
build() {
cd $startdir/src/
mkdir $startdir/pkg/opt/
cp -r $_pkgname $startdir/pkg/opt/$_pkgname
mkdir -p $startdir/pkg/usr/bin
ln -s /opt/$_pkgname/$_pkgname $startdir/pkg/usr/bin/$_pkgname

Can anyone explain this for me pls .. Thanks

interface Serial1/0
description S4/0 STUN 1 ELZBP S2/0 EMPC 7 Sec3 Cab1 IO346/J1
mtu 2104
no ip address
encapsulation stun
clockrate 56000
stun group 1
stun route all tcp 10.0.14.1

Hello Ocporbust,
this serial interface is configured for a form of tunneling called STUN
every SDLC frame that is received is placed inside a TCP segment and sent to 10.0.14.1.
It should be related to some form of IBM or mainframe networking.
STUN SDLC is most commonly used in two environments: FEP to remote controller, and AS/400 to remote controller.
see
http://www.cisco.com/en/US/tech/tk827/tk369/technologies_tech_note09186a00800b451e.shtml#stun_sdlc
Hope to help
Giuseppe

Can anyone explain this for me?

String outPutLine=bufr.readLine();
StringTokenizer inReader = new StringTokenizer(outPutLine,":");
String type=inReader.nextToken();
What does this StringTokenizer actually mean, how to use this to cut String.

you can use:
if(inReader.hasMoreElements){
String string=inReader.next();
}

Can anyone read this for me? (erro messege)

http://i286.photobucket.com/albums/ll92/cindy60635/ADOBE.png
operation system: Windows 7 64-bit
web browser: Internet Explorer 64-bit
player version: WIN 10,1,53,64
Every thing was fine yesterday that I can play videos on website, and today a messege says I need upgrade or anything that needs flash would not work. And theres the problem I can't install it.

Install it under an Administrator account.
(Or save the installer to disk, then run it 'As Administrator'.)

Hi all, I upgraded my MBP to Lion , but on the screen where i need to type my password, click on my photo and it does not appear the place for me to type my password and it stay stuck there. Can anyone solve this problem for me?

Hi all, I upgraded my MBP to Lion , but on the screen where i need to type my password, click on my photo and it does not appear the place for me to type my password and it stay stuck there. Can anyone solve this problem for me?

Reboot the machine holding Command and r keys down, you'll boot into Lion Recovery Partition
In there will be Disk Utility, use that to select your Lion OS X Partition and Repair Permissions.
After that is done reboot the machine and see if you can log in.
If not repeat the above steps to get into Lion Recovery, get online and reinstall Lion again, it will overwrite the installed version and hopefully after that it wil work.
Reboot and try again.
If not follow my steps to create a Snow Leopard Data Recovery drive, then option boot from it and grab a copy of your files off the machine.
Then reinstall all your programs onto the external drive like setting up a new machine, then use Disk Utility to erase the entire internal boot drive (select the drive media on the far left, not the partiton slightly indented) format Option: GUID , 1 partition OS X Extended and then use Carbon Copy Cloner to clone the external to the newly formatted internal drive. Once that is finished reboot and disconnect the external drive.
Once you go that, boot into Snow Leopard and update to 10.6.8, use the AppStore and option click on Purchases and download Lion again and install.
Lots of work, but there is no Lion disks.
https://discussions.apple.com/message/16276201#16276201

When i update my IOS7 i lost my all pic from my IPAD2 how to get back those pic? and i don,t think so i did kept back up before i did that. can anyone help me for this issue?

When i update my IOS7 i lost my all pic from my IPAD2 can anyone suggest how to get back those pic? and i don,t think so i did kept back up before i update ios7. can anyone help me for this issue?

The photo's in your camera roll would be in a backup, if you have one (iCloud or iTunes). If you did not keep a backup somewhere, they are gone. Sorry, but that is the way of any data - if you don't have a backup of it somewhere, there is nothing to restore it from.
All other photo's should be on your computer somewhere anyway - whereever you had them to sync to the device originally.

Can anyone beat this? now waited over 9 months for...

Can anyone beat this? now waited over 9 months for BT to fix my BB

I have thanks, I was just answering 06jpearce
This is what I wrote:
Over 9 months and 20 openreach appointments and my broadband is still not fixed. They have tried the "put up with it or we will just say your line is too long and we will stop all broadband service" about 3 times now, but when I point-out my next door neighbour is with TalkTalk, and their BB is fine, and also point out I've had much faster BB for years, they back down.
My speed has gone from 2Mbps to 384Kbps, and every time the phone rings the broadband disconnects.
I am an IT engineer that works from home and about 5 times a day I have to tell my customers that my BB has dropped out and then I explain that I've been waiting 9 months for BT to fix it.
Also I used to set up my customers on BT Broadband but obviously I haven't been doing that for the last 9 months.
I'm sure that the fault is in the old aluminium cable that Openreach don't want to touch (in fact that is what the last engineer told me) .
When you add up the cost of all these engineers calls, and the loss of business from the bad name you are getting, it would have been far cheaper to replace the cable.

I unable to see my network messages after upgrading to ios6 on my iphone4,can anyone help me for this issue?

I unable to see my network messages after upgrading to ios6 on my iphone4,can anyone help me for this issue?

Try to perform SMC and PRAM resets:
http://support.apple.com/kb/HT3964
http://support.apple.com/kb/ht1379
Then try a safe boot:
http://support.apple.com/kb/HT1564
Ciao.

I have set a passcode for my iphone and later I forgot it, and I tried it so many times but it was not correct now the iphone is disable it doesn't work in tune, can anyone solve this problem??

I have set a passcode for my iphone and later I forgot it, and I tried it so many times but it was not correct now the iphone is disable it doesn't work in tune, can anyone solve this problem??

You can solve this problem. Just follow these instructions:
http://support.apple.com/kb/ht1212

Thanks for a stealth fix - can anyone confirm this actually happened?

When the Yoga 2 Pro was released I received an error message about an unauthorized power supply when using with my energizer xpal external battery. It was only a nuisance since the battery continued to work. After this last power update I have not seen that message at all and my laptop continues to work well while on the external battery. Can anyone confirm this was an undocumented fix?

I know they fixed an error message when using other power supplies in the bios when they released the latest (11/7 I think) bios update.

Can anyone check this for me, nat overload, static and default routes, dhcp

Similar Messages

Maybe you are looking for