A Cisco Router on a Residential Connection

21 August 2023 · Updated 9 August 2026

The Ubiquiti EdgeRouter X at home died, and I had a spare Cisco 2800 Series router and a Catalyst 2960 PoE switch sitting around. Back to the late 2000s enterprise feel, with a very much not-silent fan.

The routing and the NAT were fine. The problem is that this equipment was built for a customer with a static WAN address, a change window, and somebody whose job is the router. I had a residential connection where the address changes when the ISP decides it changes.

Cisco’s example configs are written for that customer. They open by assigning the WAN address, which is the one thing I couldn’t do.

Passwords below are placeholders. Replace with your own.

The three lines that matter

The WAN interface takes a lease:

interface FastEthernet0/0
  description wan
  ip address dhcp
  ip nat outside
  no shutdown

That gets an address and nothing else. You can reach the ISP’s gateway and nothing past it, because IOS won’t install a default route out of a lease unless you ask:

ip route 0.0.0.0 0.0.0.0 FastEthernet0/0 dhcp

The trailing dhcp is the whole thing. Without it you either hardcode a next hop that changes with the lease, or point the route at the interface alone and leave the router ARPing for every destination on the internet.

NAT has the same problem somewhere else. A pool wants you to name the outside address, and naming it is the thing you can’t do:

access-list 1 permit 192.168.1.0 0.0.0.255
ip nat inside source list 1 interface FastEthernet0/0 overload

Overloading the interface translates to whatever it happens to be holding, so the lease can change underneath it without anything needing to be told.

The rest of the config

The LAN side, which is ordinary:

interface FastEthernet0/1
  description lan
  ip address 192.168.1.1 255.255.255.0
  ip nat inside
  no shutdown

Turn off DNS lookup on typos. Otherwise a mistyped command becomes a several second pause while the router tries to resolve it as a hostname, which is the router trying to help:

no ip domain lookup

Passwords and access:

security passwords min-length 8
service password-encryption

enable secret <enable-password>

line vty 0 4
  password <vty-password>
  login
line con 0
  password <console-password>
  login

Port forwarding, using the same interface-follows-the-lease idea. This sends inbound TCP 3000 to a host on the LAN:

ip nat inside source static tcp 192.168.1.194 3000 interface FastEthernet0/0 3000

Switch configuration

Catalyst 2960 on IOS 12.2, with VLAN 1 shut down, passwords set, and its default gateway pointed at the router:

hostname Switch
!
enable secret <enable-secret>
!
no ip domain-lookup
!
interface Vlan1
 no ip address
 shutdown
!
ip default-gateway 192.168.1.1
ip http server
ip http secure-server
!
line con 0
 password <console-password>
 login
line vty 0 4
 password <vty-password>
 login
line vty 5 15
 login

The 24 FastEthernet ports and both GigabitEthernet uplinks stay on defaults. Anything beyond that, VLANs, trunking, port-channels, goes per interface.

I rebuilt the topology in Packet Tracer, which is a better place to find out what a command does than the router everyone in the house is currently using.

It lasted a few weeks

The 2800 worked, and it didn’t stay. Routing moved to OPNsense in a VM on the Proxmox host that was already running there, a Dell PowerEdge R210 ii, and the 2960 stayed on as the core switch.

The configuration took an evening. The fan was a decision I had to keep making.

Further reading

• Basics to configure a Cisco router to connect to the internet (archived, the original is gone)