What is the permit-inside feature?

What is the permit-inside feature?

A server on the intranet is mapped to a public IP address, which is registered in a domain. When a user on the intranet accesses the server by using the domain name, the domain name server (DNS) resolves the server address to the registered public IP address. When the user uses the public IP address to access the server, by default, the router determines that the traffic is normal passing traffic and converts the source IP address.Before the conversion, the router detects that the public IP address and the external network port are on the same network segment, and then sends an ARP request for resolving the MAC address from the public IP address. Because the network segment does not have any terminal configured with the public IP address, the router receives no response to the ARP request. As a result, source IP address conversion fails. The following happens when a user on the intranet accesses the server by using its public IP address: The router without any related NAT entry sends an ARP request only on the external network port,and the user receives no response. To solve this problem, you need to configure the permit-inside feature.

Run the following command to configure the permit-inside feature on the router:

ip nat inside source static tcp 192.168.1.254 23 10.0.0.1 23 permit-inside

Telnet to 10.0.0.1 from 192.168.1.2 on the intranet, and then check whether the following NAT entry exists on the router:

RSR#sh ip nat tran

Pro  Inside global     Inside local             Outside local  Outside global

tcp   10.0.0.1:1046   192.168.1.2:1046   10.0.0.1:23     192.168.1.254:23

After the permit-inside feature is configured, the router converts the source and destination IP addresses of corresponding packets.

	Source IP address	Destination IP address
Before NAT	192.168.1.2:1046	10.0.0.1:23
After NAT	10.0.0.1:1046	192.168.1.254:23