Have you ever had to deal with something so insanely stupid, that you just know it's going to ruin your week?
Then as time goes on, you realize that your previously-thought-to-be-over-apathetic assumptions were actually fairly conservative?
Thanks Alvarion, thanks a #$%*^)$ bunch. January 24th, and I'm already considering the year ruined.
It occurred to me today, that there has to be a better way of doing port ranges on non-asa, or non-pix type routers.
Ie;
R2# sh run | incl ip nat ip nat inside source static tcp 10.0.0.25 5001 interface FastEthernet 0/0 5001 ip nat inside source static tcp 10.0.0.25 5002 interface FastEthernet 0/0 5002 ip nat inside source static tcp 10.0.0.25 5003 interface FastEthernet 0/0 5003 ip nat inside source static tcp 10.0.0.25 5004 interface FastEthernet 0/0 5004 ...
And, here's what I came up with after a bit of screwing around:
R2(config)#do sh run | incl ip nat ip nat pool 172-16-0-21 172.16.0.21 172.16.0.21 netmask 255.255.255.0 type rotary ip nat inside source list 1 interface FastEthernet0/0 overload ip nat inside destination list 100 pool 172-16-0-21 R2(config)#do sh run | incl access-list access-list 1 permit 172.16.0.0 0.0.0.255 access-list 100 remark Test NAT port range for retarted machine access-list 100 permit tcp any any range 5000 5010 R2(config)#do sh ip nat trans Pro Inside global Inside local Outside local Outside global tcp 10.0.0.1:5001 172.16.0.21:5001 10.0.0.254:17855 10.0.0.254:17855 tcp 10.0.0.1:5002 172.16.0.21:5002 10.0.0.254:41679 10.0.0.254:41679 tcp 10.0.0.1:5003 172.16.0.21:5003 10.0.0.254:57521 10.0.0.254:57521 tcp 10.0.0.1:5004 172.16.0.21:5004 10.0.0.254:35512 10.0.0.254:35512 tcp 10.0.0.1:5005 172.16.0.21:5005 10.0.0.254:42845 10.0.0.254:42845 tcp 10.0.0.1:5006 172.16.0.21:5006 10.0.0.254:61046 10.0.0.254:61046 tcp 10.0.0.1:5007 172.16.0.21:5007 10.0.0.254:47539 10.0.0.254:47539
So ssh'ing to a BSD qemu host on 172.16.0.21 with sshd listening on a few dozen ports, and whammo - seems to work just fine, and that config looks so much nicer.
I don't see why UDP wouldn't work either, and you could presumably just add more fine-grained stuff to the ACL instead of a hojillion separate ip nat translation inside source static tcp <host> <port> interface <foobar> statements.
AND, you get to put remarks in an ACL. Joy of Joys!
In doing this, I also learned that enabling NAT on a 3725 in GNS is a bad plan when your router only has 128 megs of Ram. Though the fireworks display is impressive, it's not pleasant at the same time.
