Back to blog

Cisco / IOS  ·  Tutorial  ·  July 2026

Cisco IOS
DHCP & NAT/PAT

The two services that make a LAN usable: handing out addresses automatically, and sharing one public IP across the whole office. DHCP pools, relay, PAT overload, and static NAT for port forwarding — with the verify commands that make troubleshooting quick.

Cisco IOS DHCP NAT PAT Port Forwarding Router CCNA

192.168.1.10 192.168.1.11 192.168.1.12 inside (private) R1 PAT overload 203.0.113.7 outside (one public IP) Many private hosts → one public IP. The router tracks each flow by port number so replies find their way home.

Two services turn a bare router into a working internet gateway. DHCP hands every device an IP, gateway, and DNS server automatically — no one configures a laptop by hand. NAT translates the many private addresses behind you into the one (or few) public addresses your ISP gave you, so the whole office shares a single WAN IP.

In practice you'll use one flavour of NAT constantly — PAT, "NAT overload", which multiplexes an entire LAN onto one public IP by tracking port numbers — and occasionally its inverse, static NAT, to publish an internal server to the internet (port forwarding). This tutorial builds all of it on an IOS router, then maps it to the MikroTik equivalents. If you set up masquerade and dst-nat on RouterOS, you already know the shapes.

Prerequisites

01

DHCP Server on IOS

A Cisco router makes a perfectly good DHCP server for a small site. Exclude the static addresses first, then define a pool — network, gateway, DNS, lease time.

IOS — a DHCP pool for the LAN
# 1. Reserve the addresses DHCP must NOT hand out (gateway, servers, printers)
R1(config)# ip dhcp excluded-address 192.168.1.1 192.168.1.20

# 2. Define the pool
R1(config)# ip dhcp pool LAN
R1(dhcp-config)# network 192.168.1.0 255.255.255.0
R1(dhcp-config)# default-router 192.168.1.1
R1(dhcp-config)# dns-server 1.1.1.1 8.8.8.8
R1(dhcp-config)# domain-name noctis.lan
R1(dhcp-config)# lease 0 12 0          # 0 days, 12 hours, 0 minutes
R1(dhcp-config)# end
⚠ Gotcha — Exclude BEFORE You Rely on the Pool

The network statement makes the router willing to lease every address in that subnet — including your gateway .1 and any static servers — unless you excluded them. If you skip ip dhcp excluded-address, DHCP will happily hand a client the same IP as your router or a printer, and you'll chase a duplicate-address ghost for an hour. Exclude the static block first, every time.

Verify the Leases Safe to Run

IOS — confirm DHCP is handing out addresses
R1# show ip dhcp binding
IP address       Client-ID/Hardware   Lease expiration      Type
192.168.1.21     0100.1a2b.3c4d.5e     Jul 12 2026 09:14 PM  Automatic
192.168.1.22     0100.1a2b.3c4d.6f     Jul 12 2026 09:15 PM  Automatic

R1# show ip dhcp pool
Pool LAN :
 Total addresses            : 254
 Leased addresses           : 2
 Excluded addresses         : 20

# Conflicts (an address DHCP found already in use) show up here:
R1# show ip dhcp conflict

02

DHCP Relay — When the Server Is Elsewhere

DHCP uses broadcasts, and routers don't forward broadcasts. So a client in VLAN 20 can't reach a DHCP server in VLAN 10 — unless the gateway relays the request. That's ip helper-address.

IOS — relay DHCP from a client subnet to a central server
# On the interface/SVI that faces the CLIENTS (their default gateway),
# point at the DHCP server's unicast address:
R1(config)# interface vlan 20
R1(config-if)# ip helper-address 192.168.10.5
R1(config-if)# end
# The router now converts the client's DHCP broadcast into a unicast to
# 192.168.10.5, stamping the source subnet so the server picks the right pool.
💡 Pro Tip — helper-address Goes on the Client Side, Not the Server Side

The most common relay mistake is putting ip helper-address on the wrong interface. It belongs on the interface closest to the clients — the one that receives their broadcast — pointing at the server. One helper per client subnet. And ip helper-address relays more than DHCP by default (TFTP, DNS, NTP and a few others); if you only want DHCP, prune the rest with no ip forward-protocol udp <port>.

03

NAT — The Vocabulary First

NAT confuses people because of four terms that sound alike. Nail them once and every NAT command reads plainly. Inside/outside is about which side of the router; local/global is about which address — private or public.

TermMeans
inside localThe private IP a host really has (192.168.1.10).
inside globalThe public IP the world sees that host as (203.0.113.7).
outside globalA public IP out on the internet (e.g. a web server you visit).
inside interfaceThe router leg facing your LAN — marked ip nat inside.
outside interfaceThe router leg facing the WAN — marked ip nat outside.

Every NAT config starts the same way: tell the router which interface is inside and which is outside. Nothing translates until you do.

IOS — mark the interfaces (always step one)
R1(config)# interface GigabitEthernet0/1
R1(config-if)# ip nat inside          # LAN side
R1(config-if)# exit
R1(config)# interface GigabitEthernet0/0
R1(config-if)# ip nat outside         # WAN side
R1(config-if)# end

04

PAT — One Public IP for the Whole LAN

This is the NAT you'll configure 95% of the time. PAT (NAT overload) maps every inside host to the single public IP on your WAN interface, keeping flows apart by port number. It's exactly what your home router does.

IOS — PAT overload onto the WAN interface IP
# 1. An access-list describing WHO is allowed to be translated (the LAN)
R1(config)# access-list 1 permit 192.168.1.0 0.0.0.255
#   (0.0.0.255 is the wildcard mask — the inverse of 255.255.255.0)

# 2. Translate that list, overloaded onto the outside interface's IP
R1(config)# ip nat inside source list 1 interface GigabitEthernet0/0 overload
R1(config)# end
# "overload" is the keyword that turns NAT into PAT (port multiplexing).
# Every LAN host now reaches the internet as the WAN interface's public IP.
⚠ Gotcha — No Route, No NAT

NAT translates addresses; it does not route packets. If the router can't already reach the internet — a default route ip route 0.0.0.0 0.0.0.0 <next-hop> out the outside interface — then translated traffic still goes nowhere. Likewise, if you forget ip nat inside/outside on the interfaces, the ip nat inside source rule matches nothing and hosts get no translation at all. Interfaces marked, route present, then NAT.

05

Static NAT — Port Forwarding

PAT lets inside hosts reach out. To let the outside reach IN — publish a web server, a mail server, a camera NVR — you need a static mapping: a fixed public IP:port to a fixed private IP:port.

IOS — forward one public port to an internal server
# Publish internal 192.168.1.10:443 as the WAN IP's port 443
R1(config)# ip nat inside source static tcp 192.168.1.10 443 interface GigabitEthernet0/0 443

# Or, if you have a spare dedicated public IP, map it whole:
R1(config)# ip nat inside source static 192.168.1.10 203.0.113.8
R1(config)# end
# Remember the firewall/ACL still has to PERMIT the inbound traffic —
# NAT opens the address translation, not the door.
💡 Pro Tip — Forward Only the Exact Port You Mean

Prefer the tcp <ip> <port> interface … <port> form over mapping a whole address whenever you can. Exposing a single service port (443) is a far smaller attack surface than publishing an entire host to the internet. And always pair a static NAT with an inbound ACL that permits only that port from the sources that need it — a forwarded RDP or camera port open to the whole internet is one of the most-scanned holes there is.

06

Verify & Troubleshoot NAT Safe to Run

Two commands answer almost every NAT question: what's currently translated, and are translations even happening.

IOS — the NAT translation table and counters
R1# show ip nat translations
Pro  Inside global        Inside local       Outside local     Outside global
tcp  203.0.113.7:1044     192.168.1.10:1044  93.184.216.34:443 93.184.216.34:443
tcp  203.0.113.7:443      192.168.1.10:443   ---               ---            
# Top line: a host reaching out (PAT). Bottom: your static port-forward.

R1# show ip nat statistics
Total active translations: 2 (1 static, 1 dynamic; 1 extended)
Outside interfaces: GigabitEthernet0/0
Inside interfaces:  GigabitEthernet0/1
Hits: 1523  Misses: 0

# Watch translations happen live (turn it OFF the moment you're done):
R1# debug ip nat
R1# undebug all

# Clear the dynamic table to start fresh (static entries stay):
R1# clear ip nat translation *
⚠ Gotcha — "show ip nat translations" Is Empty

An empty dynamic table when hosts should be online almost always means one of three things: the interfaces aren't marked ip nat inside/outside; the access-list doesn't match the source subnet (check the wildcard mask — 0.0.0.255, not 255.255.255.0); or there's no route to the outside. Static entries always show even with zero traffic, so if your static forward is listed but no dynamic entries appear, suspect the ACL or the inside/outside marking.

07

MikroTik ↔ Cisco — The Same Two Jobs

If you built masquerade and dst-nat on RouterOS, Cisco NAT is the identical concept with different keywords. Here's the direct map.

MikroTik / RouterOSCisco IOS
/ip pool + /ip dhcp-serverip dhcp pool + ip dhcp excluded-address
dhcp-relayip helper-address
action=masquerade (srcnat)ip nat inside source list … overload (PAT)
action=src-nat to-addresses=<pub>ip nat inside source static <local> <global>
action=dst-nat (port forward)ip nat inside source static tcp … interface … <port>
/ip firewall connection trackingshow ip nat translations
💡 The Real Difference

On MikroTik, NAT is a firewall action — a rule in the srcnat/dstnat chain, evaluated with everything else. On Cisco, NAT is its own subsystem: you mark interfaces inside/outside and write ip nat rules separately from the ACL/firewall. Same result, different mental model. When we run mixed sites — a MikroTik edge and Cisco core, common in Crete SMBs — this table is what keeps the two straight in everyone's head.

Takeaways

  1. Exclude static addresses before you trust a DHCP pool. The network statement offers the whole subnet; ip dhcp excluded-address is the only thing stopping DHCP from leasing your gateway and servers out from under you.
  2. Routers don't forward broadcasts — that's why relay exists. ip helper-address goes on the interface facing the clients, pointing at a central DHCP server. One per client subnet.
  3. Learn the four NAT terms once. inside/outside = which side of the router; local/global = private/public address. Every ip nat command reads plainly after that.
  4. Mark interfaces first. No ip nat inside/outside means no translation, no matter how correct the rules are. Interfaces marked → route present → NAT rule.
  5. PAT (overload) is the everyday NAT. An ACL for the LAN plus ip nat inside source list … interface … overload puts the whole office behind one public IP.
  6. Static NAT publishes inward — forward the exact port, and firewall it. NAT opens the translation, not the door; pair every port-forward with an inbound ACL scoped to just that service and source.
  7. Two show commands debug almost everything. show ip nat translations (what's mapped) and show ip nat statistics (is it happening) — an empty table points straight at interface marking, the ACL wildcard, or a missing route.

Standing up a gateway for an office, hotel, or SMB in Crete?

NOCTIS configures DHCP, NAT, and secure port-forwarding on Cisco and MikroTik edges — with the firewall rules that keep published services safe — and documents every mapping so your team knows exactly what's exposed and why.

Book a Discovery Call →