RV042 Router Firewall blocks ports though Access Rule

[ponninga001]

Hi  I have a Cisco RV042 Wired Router.

I've got a static IP and a MS Small Business Server in my Router Network.

I have forwarded the essential ports to use the IIS and the Exchange Server of my SBS2011 (https, http, smtp, rpc).

I have also created some access rules for these ports, but I dont have any access on my server services, if the firewall is activated.

Here are my Firewall Access Rules from the RV042 Web Interface:

Priority	Policy Name	Enable	Action	Service	Source Interface	Source	Destination	Time	Day		Delete
	HTTPS 2nd		Allow	HTTPS 2nd [987]	*	Any	10.0.0.2 ~ 10.0.0.2	Always
	SMTP 2nd		Allow	SMTP 2nd [587]	*	Any	10.0.0.2 ~ 10.0.0.2	Always
	FTP		Allow	FTP [21]	*	Any	10.0.0.2 ~ 10.0.0.2	Always
	HTTP		Allow	HTTP [80]	*	Any	10.0.0.2 ~ 10.0.0.2	Always
	RPC		Allow	RPC [135]	*	Any	10.0.0.2 ~ 10.0.0.2	Always
	SMTP		Allow	SMTP [25]	*	Any	10.0.0.2 ~ 10.0.0.2	Always
	HTTPS		Allow	HTTPS [443]	*	Any	10.0.0.2 ~ 10.0.0.2	Always
			Allow	All Traffic [1]	LAN	Any	Any	Always
			Deny	All Traffic [1]	WAN1	Any	Any	Always
			Deny	All Traffic [1]	WAN2	Any	Any	Always

Maybe someone can help me

[cadet alain]

Hi,

I've never worked with this router model but maybe you should try to put as destination IP the public IP which is used in the port forwarding entries.

Regards.

Alain

[Beetlejuice01]

are you trying to enter in your lan from a wan? are you trying to pass over a nat interface?

[ponninga001]

i've tried both things but with no success.

Do I have to connect the DMZ Port for using the DMZ Mode?

[cadet alain]

Hi,

did you try changing the  destination to the public IP of the router ,

I suppose this is for external access to these services?

from where are you trying vto access these services?

Regards.

Alain

[ponninga001]

yeah i tried this, but without success.

I tested a TCP connection on port 25 (SMTP) but the server didnt receive anything.

[cadet alain]

Hi,

from where did you connect? is this working with NAT on but Firewall disabled?

Regards.

Alain

[ponninga001]

if the firewall is disabled everything works fine. After enabling the fw the forwarded services are blocked.

How do i have to configure the NAT to receive all traffic at the server?

best regards

thomas

[cadet alain]

Hi,

if you can connect from outside when  the firewall is off then it means NAt is ok.

Regards.

Alain

[Beetlejuice01]

Thomas how are you connecting to that server... some service like dyndns...? In the rule you have specified 10.0.0.2 but i suppose you have done a port forwarding from a public ip, so you connect from the outside network to a public ip because there is no vpn to connect inside network. Please give us more detail.. a basic picture, a configuration a topology or it's hard to help you. You say without firewall activated the connection was established, with nat but you don't browse the private ip i immagine... have you tryied to change the private ip with translated ip?

[ponninga001]

i've got a static internet ip address.

i connect to my server, or actually i'm trying to connect to my server with the public internet ip address.

The local ip of my router is 10.0.0.1 and of the server 10.0.0.2

i've forwarded the service ports to 10.0.0.2 ip address and added the firewall access rules- destination ips (from the services in the table) to my public ip address.

would the cisco rvs4000 meet my needs better?

i read the datasheet of it yesterday and there have been an application node for connecting to public servers in the router network.

best regards

thomas

[cadet alain]

Hi,

If you try accessing your public IP from inside it may well not work if this router doesn't support hairpinning.

To test this you must connect from outside.

Regards.

Alain

[ponninga001]

yeah i try to connect from my homenetwork to my business network (static ip). I'm not connected via VPN and i try to connect with the public IP address (188.21.6........)

regards

[Beetlejuice01]

:-) connect from an outside network as Alan suggest and probably your configuration works well.

[ponninga001]

i always connect from outside