Part 2 ended with a network of one street: the laptop and the router can talk, SSH works, and show ip route says Gateway of last resort is not set. That means the router doesn't know about anything beyond its own street. This page plugs the router's other port into your home router and gets the laptop onto the Internet through the 1921. Along the way you'll see it fail once, on purpose, because the reason it fails is the most important idea on the page. Same laptop, same router, one more cable.
Here's the lab after this page. Part 2's cables stay exactly where they are. The only new thing is a cable from the router's GE 0/0 to a spare LAN port on your home router (the box your ISP gave you, or whatever hands out Wi-Fi in your house).
In Part 2 the router had one foot on one street. Now it has one foot on each street, which is what a router is for. GE 0/1 stays on your lab street, 192.168.10. GE 0/0 joins your home street. That street is probably 192.168.1 or 192.168.0, and you don't have to know which, because the router will ask for an address the same way your laptop did in Part 2.
From here on, GE 0/0 is called the WAN side (wide area network: the way out) and GE 0/1 the LAN side (local area network: your stuff). Every Cisco guide, including the rest of this series, uses those two words.
Unusual, but it happens. Check on any device on your Wi-Fi: ipconfig on Windows, or System Settings → Wi-Fi → Details on a Mac. If its address starts 192.168.10., the router can't have the same street on both ports and will refuse the WAN address with an overlaps message. Either change your home router's LAN range, or redo Part 2 with 192.168.20 everywhere it says 192.168.10. Everything else on this page works the same.
Plug the new cable in: GE 0/0 on the 1921 into any LAN port on your home router. Then SSH to the router as you did at the end of Part 2 (ssh admin@192.168.10.1). The console cable can stay in the drawer. On the WAN port you don't type an address. Your home router already runs a DHCP server, so the 1921 asks it for one, just as your laptop asked the 1921 in Part 2:
configure terminal interface GigabitEthernet0/0 description WAN - to home router ip address dhcp no shutdown end
You already know the first two log lines from Part 2: the cable is in, and both ends agree on speed. The third one is new. It says the home router answered and handed out 192.168.1.47. Your numbers will differ, which is fine. Write down the address you got. On this page it's always .1.47, and your home router is always .1.1.
Log messages go to the console by default, not to SSH sessions. To see them over SSH, type terminal monitor once after logging in (it lasts until you disconnect). Or just run the check below, which shows the same result.
show ip interface brief
Look at the Method column. GE 0/1 says manual because you typed that address. GE 0/0 says DHCP because it was handed one. Both ports are up / up, so the router now sits on two streets.
If the IP-Address column still says unassigned after 30 seconds, check the far end of the cable. It must go into a LAN port on the home router, not the port marked WAN or Internet. Some ISP boxes also have their spare ports turned off, so try a different one. To make the router ask again without rebooting, run shutdown then no shutdown on the interface.
In Part 2, show ip route knew one street and nothing else. Run it again:
show ip route
Three things changed, and you didn't type any of them:
C line. 192.168.1.0/24 is directly connected on GE 0/0. The router now knows two streets because it has a foot on each.S* 0.0.0.0/0 via 192.168.1.1 is the default route. 0.0.0.0/0 means every address there is. The route says: “for anything I don't have a more specific line for, hand it to 192.168.1.1.” Your home router's DHCP reply said “I'm the way out” (the same default-router option you configured in your own pool in Part 2), and IOS turned that into this route. S means static, the * means it is the default, and [254/0] is a trust rating you can ignore for now.The router always uses the most specific line that matches. A packet for 192.168.10.11 matches both the /24 line and 0.0.0.0/0. The /24 is more specific, so it goes out GE 0/1 to the laptop. A packet for 1.1.1.1 matches only 0.0.0.0/0, so it goes to the home router. Every router in the world makes its decisions this way.
Prove it. From the router:
ping 1.1.1.1
1.1.1.1 is Cloudflare's public DNS server. It's a real address on the real Internet that always answers pings and is easy to remember. The 1921 is online.
With DHCP on the WAN, the default route arrives by itself. If you're ever given a fixed address instead (a business line, or a lab where nothing hands out addresses), you set the address with ip address 203.0.113.10 255.255.255.0 and add the default route by hand: ip route 0.0.0.0 0.0.0.0 203.0.113.1, meaning everything goes to that neighbour. That line is on the Setup page's WAN step, and now you know what it means.
The routing table has a line for 192.168.10.0/24 and a line for 0.0.0.0/0, and 192.168.10.11 matches both. Explain to a friend how the router picks one, using the street idea from Part 2.
Think of a mail sorter with two bins. One is labelled “192.168.10 Street — out the left door.” The other is labelled “anywhere at all — give it to the post office next door.” A letter for 192.168.10.11 fits both labels, so the sorter uses the one that describes it most precisely, the street bin. The “anywhere” bin only gets letters that no better bin matches. That's why it's called the route of last resort: the router only uses it when it has nothing more specific.
The router can reach the Internet and the laptop can reach the router, so you'd expect the laptop to reach the Internet too. First turn the laptop's Wi-Fi off. Otherwise it would reach the Internet through Wi-Fi and prove nothing. Then, from the laptop:
ping 1.1.1.1
Nothing comes back. This isn't a typo and nothing is broken. You can reproduce the same failure from the router by telling ping to use the LAN address as its return address:
ping 1.1.1.1 source GigabitEthernet0/1
It's the same router, the same destination and the same default route. The only difference from Step 03 is the return address written on the packet. With 192.168.1.47 it works; with 192.168.10.1 it doesn't. That tells you where the problem is. The ping gets out fine. The reply can't get back.
Here's what happens. The packet leaves with the return address 192.168.10.x. Your home router receives the reply, looks for 192.168.10.0 in its own routing table, and finds nothing. It has never heard of your lab street, because nobody told it that street is behind the 1921. So it sends the reply out its own default route toward the ISP, where it's dropped. Private addresses are never routed on the Internet. (Some home routers drop the packet on the way out instead, because they don't recognise the return address. The result is the same: no reply.)
There are two ways to fix it:
192.168.10.0/24 via 192.168.1.47. That's correct, and it's how networks inside a company work, but many ISP-supplied home routers have no page for adding routes, and you'd have to redo it on every network you plug the lab into.192.168.1.47), which the home router already knows. When the reply comes back, the 1921 changes the address back and passes it to the laptop. This is NAT, and it's the next step.The router can ping 1.1.1.1, and the laptop can ping the router, but the laptop can't ping 1.1.1.1. A friend is sure the router “isn't forwarding.” Explain why it is forwarding, and what actually goes wrong.
The laptop's letter really does go out. The router passes it to the home router, and the home router sends it on to 1.1.1.1. The trouble is the return address, which says “192.168.10.11, Lab Street.” When 1.1.1.1 replies, the letter reaches the home router, and the home router has never heard of Lab Street. Nobody told it that Lab Street is behind the 1921. So it sends the letter the only way it knows, out to the Internet, where it's thrown away. Delivery was never the problem. Every trip on a network is two trips, and the way back needs a route as well.
NAT (Network Address Translation) rewrites the return address on packets leaving one side of the router, keeps a note of what it changed, and uses that note to change it back when the reply arrives. Your home router already does this for your whole house. The 1921 needs three pieces of configuration: which side is inside, which side is outside, and which addresses get translated.
configure terminal interface GigabitEthernet0/1 ip nat inside interface GigabitEthernet0/0 ip nat outside exit access-list 10 permit 192.168.10.0 0.0.0.255 ip nat inside source list 10 interface GigabitEthernet0/0 overload end
ip nat inside on GE 0/1: this port faces the private addresses that need translating.ip nat outside on GE 0/0: this port faces the rest of the world. Translation happens when a packet crosses from an inside port to an outside port, and is undone on the way back.access-list 10 permit 192.168.10.0 0.0.0.255: a list, numbered 10, that matches every address on the lab street. The odd-looking 0.0.0.255 is a wildcard mask, the subnet mask turned inside out. A 0 means “must match” and 255 means “anything goes,” so the whole line reads “192.168.10.anything.” Access lists always use wildcard masks. Everywhere else you've used normal subnet masks.ip nat inside source list 10 interface GigabitEthernet0/0 overload is the rule itself: “if a packet's source matches list 10, rewrite it to GE 0/0's address.” interface GigabitEthernet0/0 means whatever address GE 0/0 has right now, so if the home router hands out a different one next week, NAT follows it. overload lets every device on the street share that one address at the same time. Cisco also calls this PAT.Now try the laptop again:
ping 1.1.1.1
The replies came back. While the ping is still running, look at the router's notes:
show ip nat translations
Read it left to right. Inside local is the laptop's real address, 192.168.10.11. Inside global is what the outside world saw, 192.168.1.47. Outside is who it was talking to. The :1 on each address is an ID number, and that number is how overload works. When twenty laptops share 192.168.1.47, each conversation gets its own number, so the router knows which reply goes to which laptop. Translations time out after a minute or so of silence, so if the table is empty, ping again and look quickly.
Your home router also does NAT, so a packet from the laptop is translated twice: once by the 1921 (192.168.10.11 → 192.168.1.47) and once by the home router (192.168.1.47 → your real public address). This is called double NAT. For browsing, updates and SSH out it makes no difference. It only gets in the way when something on the Internet needs to connect in to your lab, which is a problem for the NAT guide.
Three laptops on the lab street all load a web page at the same moment. The outside world sees only one address, 192.168.1.47. When the three replies arrive, how does the 1921 know which reply belongs to which laptop?
It's like an office building with one street address and a mail room. Every letter going out is stamped with the building's address plus a room number the mail room makes up (“Room 51,002”), and the mail room writes down which person that room number belongs to. The replies all arrive at the same building address, but each one carries its room number, so the mail room checks its notebook and delivers it to the right desk. The router's notebook is show ip nat translations, and the room numbers are the :number after each address. That's what overload means: one address, overloaded with many room numbers.
People don't type 1.1.1.1. They type bozcode.com. Turning a name into an address is the job of a DNS server, and your laptop already knows which ones to ask. The dns-server 1.1.1.1 8.8.8.8 line in Part 2's DHCP pool told it. That line did nothing then, because those servers were out of reach. Now they aren't:
nslookup bozcode.com
The Server line is the one to check: the laptop asked 1.1.1.1, the DNS server the 1921's DHCP pool gave it. Open a browser and load any website. It's going through the 1921. To see that for yourself, trace the path:
tracert -d 1.1.1.1
Each line is a router the packet went through. Hop 1 is the 1921, and hop 2 is your home router. After that it's your ISP and the Internet. (-d skips looking up a name for each hop, which makes it much faster. On Mac and Linux use traceroute -n 1.1.1.1.) If hop 1 is your home router instead of 192.168.10.1, the laptop is still using Wi-Fi.
If ping 1.1.1.1 gets replies but nslookup times out, the laptop has the wrong DNS server, usually one left over from Part 2's Step 03 manual settings. Check that the Ethernet adapter is set to Automatic for DNS as well as for the address (on Windows they're two separate switches). Then disconnect and reconnect so it gets a fresh lease. ipconfig /all should list 1.1.1.1 under DNS Servers.
Run ping google.com on the 1921 and you'll get Unrecognized host. That's Part 1's no ip domain-lookup at work: you turned off name lookups on the router so a mistyped command wouldn't freeze the prompt for 30 seconds while it tried to look the typo up. The router doesn't need names to route. Only the devices behind it do, and they have their own DNS settings.
The 1921 now has an address on your home network too, which creates a problem you didn't have before. In Part 2 you allowed SSH on line vty 0 4, and that setting doesn't care which port a login comes in on. Anyone on your home Wi-Fi can now reach 192.168.1.47 and get the router's password prompt. That includes a housemate, a guest, or a phone with malware on it. One password is all that stands between them and your router.
The fix is a second access list, the same kind you wrote for NAT, this time used as a guest list for logins:
configure terminal access-list 20 permit 192.168.10.0 0.0.0.255 line vty 0 4 access-class 20 in end
access-list 20 permit 192.168.10.0 0.0.0.255: the lab street again, in a new list numbered 20. Every access list ends with an invisible deny everything else, so any address not on the list is refused.access-class 20 in under the vty lines: check list 20 before accepting a login, and refuse anyone who isn't on it.Test both sides. From the laptop on Ethernet, ssh admin@192.168.10.1 still works. Now turn Wi-Fi back on, unplug the laptop's Ethernet cable, and try the WAN address from your home network:
ssh admin@192.168.1.47
The connection is refused before any password prompt appears, which is the result you want. Some SSH clients say Connection closed instead; it means the same thing. Plug the Ethernet cable back in (and turn Wi-Fi off again if you're continuing).
Make this change over an SSH session from the lab side, or with the console cable to hand. If you mistype the network in access list 20, your next SSH login will be refused too, and the console cable is the way back in. That's why it went in the drawer and not in the bin.
Everything so far is only in the running config. You know the rule from Part 1:
write memory
Then look at what this page added, all at once:
show running-config | include ^interface|ip nat|access|dhcp$
That's this page in seven lines, with the interface names printed so you can see which port each setting belongs to. The | characters inside the filter mean or, so the router shows any line that matches any of the four patterns. ^interface matches lines that start with interface, and dhcp$ matches lines that end with dhcp. A useful companion command shows NAT's running totals:
show ip nat statistics
If NAT ever stops working, this is the first place to look. Check that both interfaces are listed on the correct side, since a missing ip nat inside is the most common mistake. Also check that Hits keeps climbing while the laptop is using the Internet.
show ip interface brief: GE 0/0 has a DHCP address and GE 0/1 still has 192.168.10.1, both up / upshow ip route: Gateway of last resort is setping 1.1.1.1 gets !!!!!ping 1.1.1.1 gets repliesnslookup bozcode.com answers, and a website loadstracert -d 1.1.1.1 shows 192.168.10.1 as hop 1192.168.10.1 works, and SSH to the WAN address is refusedwrite memory done| Symptom | Most likely cause |
|---|---|
| GE 0/0 up but unassigned | Cable in the home router's WAN port instead of a LAN port, or a dead port. Move it, then shut / no shut. |
| Router can't ping 1.1.1.1 | No default route. Check that show ip route has the S* line. If the WAN address is typed in rather than DHCP, you need the ip route 0.0.0.0 0.0.0.0 line. |
| Router can, laptop can't | NAT. Check show ip nat statistics for both interfaces and the ACL network. |
| Laptop pings 1.1.1.1 but no websites | DNS. See the Step 06 callout, then ipconfig /all. |
| Everything “works” but tracert hop 1 isn't .10.1 | The laptop is using Wi-Fi. Turn it off. |
| SSH refused from the lab too | A typo in access list 20. Use the console cable: show access-lists, fix it, save. |
The 1921 is now a real router: two streets, a default route, NAT so the lab can get out, and management that only answers on the lab side. The only limit left is that GE 0/1 has one laptop on it. The next page adds a switch, so the lab street can hold 24 devices.
Add the 24-port switch between the router and your devices, give it a management address and SSH of its own, and run the full verification. Everything router-side on that page, from the WAN and NAT to DHCP and SSH, you've now done slowly, so it will read as review.
Going the other way: static NAT and port forwarding, so something on the lab street can be reached from outside. It also covers troubleshooting when show ip nat translations stays empty.
Default routes, access lists, NAT and the show commands from this page, together with everything from Parts 1 and 2.