Get the LAN online with one public IP
An inside LAN needs to reach the outside through a single public address. Routing's fine. The translation is what's missing.
Scenario
An inside LAN, 10.0.1.0/24, needs to reach an outside host, but the router only has one public
address, 203.0.113.1. The outside world has no route back to your private 10.0.1.0/24 (it's
private; that's the whole point), so traffic leaving with an inside source address never gets a
reply. Right now inside hosts can't get out.
The router is a plain Linux box. Routing and interfaces are already set up; no NAT is configured.
Topology
- Inside:
10.0.1.0/24; inside host10.0.1.10, gateway10.0.1.1(routereth1) - Outside: router
203.0.113.1(eth2), remote host203.0.113.10
Your job
Configure NAT overload (PAT) on the router so the whole inside LAN reaches the outside through the single public address, with the correct inside/outside interfaces. The outside host should not be able to start a connection inward.
What "done" looks like
The inside host reaches 203.0.113.10, the router's ruleset shows the masquerade rule, and the
outside host can't initiate inbound.
Teaches: PAT (NAT overload), why private LANs need translation to use a shared public address, and that translation is one-way by default; outbound state is what lets replies back in.
Tooling note
The free path here is nftables on the Linux router (nft ... masquerade in postrouting). On a
real NOS the equivalent is ip nat inside/outside plus an overload statement.
What gets checked
Your solution is verified against each of these:
- The inside host (10.0.1.10) can reach the outside host (203.0.113.10)
- The router's ruleset shows a masquerade/overload rule on the outside interface
- The outside host cannot initiate a connection to an inside host
Solve it in the browser lab
No setup, no install. Open a live lab: configure each device in the editor or its Cisco IOS terminal, run show/ping/traceroute (or test from the hosts), and watch the network react. The in-house engine grades your fix instantly and issues your proof the moment every check passes.
Open the lab →Prefer your own lab?
- Build the fix locally. New to the tooling? See setting up your lab.
- Push your topology file, device configs, and any playbooks to a public repo (GitHub or GitLab).
- Submit the repo link. We review it by hand, confirm it works, and issue your proof page.