I appreciate the help I have received from the last post on this topic, but the answers did not help. I think that someone with greater knowledge of the 837 is needed to solve this issue.
I have an 837 at home: it has a static WAN IP that I purchased from the ISP.
I have a PIX 506E at my office that has a static WAN IP that I purchased from the ISP.
I need to setup the 837 to have an IPSEC VPN to the office: completed and working
I need to allow port forwarding through the 837 to two servers on the private network: Note must be two servers, cannot be reduced to one.
The port forwarding is not working. I think it is an access-list problem, please help
Current config is attached.
If you only have 1 public IP and it's assigned to the router dialer1 interface, the router not forward port 80 if http server is enable.
Change the port of the http server on your router to something else if you need port 80 to be used by a inside server.
To specify the port number to be used by the HTTP server, use the ip http port command in global configuration mode. To return the port number to the default, use the no form of this command.
ip http port port-number
no ip http port port-number
The port number to be used for the HTTP server. Valid values are 80 or any value from 1024 to 65535. The default is 80.
The HTTP server uses port 80.
In addition to Dominic's reply i would also suggest to secure your http access to the router by using access-list binded to your http services..
I have successfully moved the http server to port 8080
I still cannot connect to any of the redirected ports from outside on the WAN.
I would appreciate help understanding why this is still a problem.
Now, i have had you pain in the past. As far as i know for port forwarding to work correctly on the 837s you need the firewall up and working too. and yours is not. :)
Below is a config that will get your port redirection working. Insert the code and test the port forwarding. (has nothing to do with the HTTP server on the router).
Now, bear in mid that this will knock out your vpn. So what i suggest is that you backup your current config, add the code below. test it and if it works we will build a firewall to suit both your vpn and port forwarding.
OK.. here it is
ip inspect name DEFAULT100 cuseeme
ip inspect name DEFAULT100 ftp
ip inspect name DEFAULT100 h323
ip inspect name DEFAULT100 netshow
ip inspect name DEFAULT100 rcmd
ip inspect name DEFAULT100 realaudio
ip inspect name DEFAULT100 rtsp
ip inspect name DEFAULT100 smtp
ip inspect name DEFAULT100 sqlnet
ip inspect name DEFAULT100 streamworks
ip inspect name DEFAULT100 tftp
ip inspect name DEFAULT100 tcp
ip inspect name DEFAULT100 udp
ip inspect name DEFAULT100 vdolive
ip inspect name DEFAULT100 icmp
ip access-group 101 in
ip inspect DEFAULT100 out
access-list 101 remark auto generated by SDM firewall configuration
access-list 101 remark SDM_ACL Category=1
access-list 101 permit tcp any any eq 80
access-list 101 permit ip 192.168.2.0 0.0.0.255 any
access-list 101 deny ip 192.168.2.0 0.0.0.255 any
access-list 101 permit icmp any host 220.127.116.11 echo-reply
access-list 101 permit icmp any host 18.104.22.168 time-exceeded
access-list 101 permit icmp any host 22.214.171.124 unreachable
access-list 101 deny ip 10.0.0.0 0.255.255.255 any
access-list 101 deny ip 172.16.0.0 0.15.255.255 any
access-list 101 deny ip 192.168.0.0 0.0.255.255 any
access-list 101 deny ip 127.0.0.0 0.255.255.255 any
access-list 101 deny ip host 255.255.255.255 any
access-list 101 deny ip host 0.0.0.0 any
access-list 101 deny ip any any log
So, like i said if this works, i will build you a firewall that includes your VPN settings. Please change the 126.96.36.199 address in the ACL 101 to your public IP address.
I tried this and also tried starting again with the setup, just adding the port forwarding.
Still no luck, would appreciate some ideas.
I have attached the latest config, just dsl and port forwarding, no nat.
I agree that it should all come together if I can get the port forwarding working.
One question, my dsl is set to Easy IP, and it gets the right IP, but should I hard code the IP as a static when I setup the DSL? Is this something that the port forwarding needs to link the outside to inside?
Hi, I have no solution and would appreciate someone helping with an 837 config that they know works. I can load this and then test and move forward.
Any assistance is appreciated.