A small office with only one public IP address, configured so every internal host can reach the internet through it — interface addressing, the default route, an ACL that decides who gets translated, Easy IP outbound NAT, verification commands, and how to add NAT Server port mapping on top of the same public address to publish an internal service.
By the AtlasCommTech engineering team — 13 years of carrier & enterprise network deployments · Updated July 2026
One public IP address, a whole office that needs to get online — Easy IP is the direct fit, not a workaround.
A small office or branch usually doesn't have a spare public IP address sitting around. The one address on the router's outbound interface is already doing its job — carrying the router's own traffic, maybe already used by another feature. Easy IP solves this without asking for anything more: it reuses the outbound interface's own IP address as the translated address for every internal host, so there's no separate address pool to size, allocate or run out of.
Below is the configuration this is based on — a router with one public-facing interface and one internal LAN, configured so internal hosts share that single public address to reach the internet, with one host deliberately excluded — plus how to layer NAT Server port mapping on top of the exact same public address so an internal service can be reached from outside.
One router, one public interface, one internal segment — with a single host carved out of the ACL that drives the translation.
Diagram labels are kept in English for engineering clarity.
Addressing
| Item | Value (this example) |
|---|---|
| Public (WAN) interface — GigabitEthernet0/0/1 | 1.1.1.2/24 |
| Peer address on the public network | 1.1.1.1/24 |
| Internal gateway interface — Ethernet0/0/1 | 192.168.0.1/24 |
| Internal LAN segment | 192.168.0.0/24 |
| Host excluded from internet access | 192.168.0.3 |
ACL 2000 — What Gets Translated
| Rule | Meaning |
|---|---|
| rule 5 deny source 192.168.0.3 0 | Explicitly excludes this one host from NAT — it never gets translated, so it never reaches the internet through this router. |
| rule 6 permit source 192.168.0.0 0.0.0.255 | Everyone else on the 192.168.0.0/24 segment is eligible for translation. |
Four moves: interface addressing, the ACL that scopes translation, Easy IP outbound NAT on the public interface, and a default route back to the ISP.
#
sysname Router
#
acl number 2000
rule 5 deny source 192.168.0.3 0
rule 6 permit source 192.168.0.0 0.0.0.255
#
interface Ethernet0/0/1
undo portswitch
ip address 192.168.0.1 255.255.255.0
#
interface GigabitEthernet0/0/1
ip address 1.1.1.2 255.255.255.0
nat outbound 2000
#
ip route-static 0.0.0.0 0.0.0.0 1.1.1.1
#When there's only one public IP address, the router's outbound interface has to double as the address the outside world uses to reach an internal server — current-interface makes that possible, on different ports.
#
sysname Router
#
acl number 3000
rule 5 permit ip source 192.168.1.0 0.0.0.255
#
nat alg ftp enable
#
interface GigabitEthernet0/0/1
undo portswitch
ip address 1.1.1.1 255.255.255.0
nat static protocol tcp global current-interface ftp inside 192.168.1.2 ftp netmask 255.255.255.255
nat static protocol tcp global current-interface 9080 inside 192.168.1.3 www netmask 255.255.255.255
nat outbound 3000
#
interface GigabitEthernet0/0/2
undo portswitch
ip address 192.168.1.1 255.255.255.0
#
ip route-static 0.0.0.0 0.0.0.0 1.1.1.2
#
returnThis example publishes an FTP server on port 21 and a web server mapped to public port 9080, both reachable through the single public address 1.1.1.1 — internal users on GE0/0/2's subnet still go out through the same Easy IP rule.
The ones that turn a five-minute Easy IP setup into a half-day of head-scratching.
SYMPTOMConfiguring nat static protocol tcp global current-interface 21 ... triggers a console warning and a yes/no prompt instead of completing immediately.
CAUSEPort 21 falls inside the well-known port range (1–1023). The device is confirming, in case another feature on the router already depends on that port range being free.
FIXRead the warning, don't just reflex-confirm it — then answer y to continue.
Warning: The port is well-known(1~1023) port. If you continue it may cause function
failure.
Are you sure to continue?[Y/N]: ySYMPTOMThe web-mapped service (public port 9080 to internal port 80) works fine from outside, but the FTP mapping (port 21) fails or hangs on data transfer.
CAUSEFTP is a multi-channel protocol — it negotiates a second connection for data transfer, and that negotiation embeds IP/port information inside the payload that plain NAT can't rewrite. HTTP is single-channel and never runs into this.
FIXEnable NAT ALG for FTP specifically; leave it off for HTTP, since HTTP doesn't need it and enabling ALGs you don't need adds inspection overhead for nothing.
nat alg ftp enableSYMPTOMThe host meant to be excluded from internet access (192.168.0.3 in this example) still gets out.
CAUSEAn ACL evaluates rules in rule-number order and stops at the first match. If a broad permit rule has a lower number than the specific deny rule for that host, the permit matches first and the deny is never reached.
FIXGive the specific deny rule the lower rule number so it's evaluated before the broad permit — exactly as in this example: rule 5 deny before rule 6 permit.
acl number 2000
rule 5 deny source 192.168.0.3 0
rule 6 permit source 192.168.0.0 0.0.0.255SYMPTOMInternal hosts can reach an internet server by its IP address, but browsing a website by name fails.
CAUSEEasy IP only handles the address translation for the traffic itself — it says nothing about how internal hosts resolve domain names in the first place.
FIXConfigure DNS separately for internal hosts — either by pointing them at a public DNS server, or per the AR series' own IP service configuration guide referenced in the source material this note is based on.
“easyip” in the Type column is necessary but not sufficient — check that the excluded host is actually excluded, too.
<Router> display nat outbound
NAT Outbound Information:
-----------------------------------------------------------
Interface Acl Address-group/IP/Interface Type
GigabitEthernet1/0/0 2000 2.2.2.1 easyip
--------------------------------------------------------------------------
Total : 1The interface name and address shown above are from the source documentation's own display nat outbound sample for an Easy IP entry — expect your own output to show the interface and address from your configuration instead.
<Router> display nat static
Static Nat Information:
Interface : GigabitEthernet0/0/1
Global IP/Port : current-interface/21(ftp) (Real IP : 1.1.1.1)
Inside IP/Port : 192.168.1.2/21(ftp)
Protocol : 6(tcp)
VPN instance-name : ----
Acl number : ----
Vrrp id : ----
Netmask : 255.255.255.255
Description : ----
Global IP/Port : current-interface/9080 (Real IP : 1.1.1.1)
Inside IP/Port : 192.168.1.3/80(www)
Protocol : 6(tcp)
VPN instance-name : ----
Acl number : ----
Vrrp id : ----
Netmask : 255.255.255.255
Description : ----
Total : 2This note is based on one worked configuration: a single router with one public interface, Easy IP outbound NAT scoped by a two-rule ACL, and an optional NAT Server port-mapping layer on the same public address. It doesn't cover NAT address-pool mode (a separate, larger address block instead of the interface's own address), VPN-instance NAT for multi-tenant setups, overlapping-address scenarios, or what happens once a second uplink enters the picture — that last one is covered in our dual-WAN failover and load-sharing configuration note.
Pulled from the same configuration cases this note is built on.
Easy IP reuses the outbound interface's own IP address as the translated address for every host — no extra public address needed, but also only one address's worth of port capacity to share. A NAT address pool (nat outbound acl address-group) uses a separate, dedicated block of public addresses, which gives more simultaneous-session headroom but requires those addresses to actually be available to assign.
Yes — that's exactly the current-interface pattern. nat static protocol tcp global current-interface
FTP negotiates a second, separate connection for data transfer and embeds addressing information for that connection inside the application payload — plain NAT can't see or rewrite that. The ALG understands FTP well enough to fix it up. HTTP doesn't negotiate a second connection this way, so there's nothing for an ALG to fix.
Not in this scenario — it's a single routing domain with no VPN instances involved. If your router does use VPN instances (for multi-tenant separation, for instance), the ACL rules do need to specify vpn-instance explicitly, or the NAT outbound rule won't match traffic from that instance at all.
The Easy IP and ACL logic stays the same on each interface, but a second uplink introduces route selection and NAT-outbound placement questions this note doesn't cover — which link carries which traffic, and how failover or load sharing is configured. See our dual-WAN failover and load-sharing configuration note for that.
Tell us your interface count, whether you need port mapping for any internal service, and we'll help you size the ACL and ports correctly.