Unable to TELNET to external router (1 way) in my 2-site home network

[Mletendr1]

All, 

I have been working on what I am willing to bet is a simple issue, but I just can't get past it.

SCENARIO:
I have a site in Illinois and a site in Connecticut. Each site is basically the same.
They each have a Cisco 2621 router running c2600-ipbase-mz.122-16.4.t image.
Each router has a NM-16-ESW card. Each FA0/0 is configured for DHCP from the broadband providers (Comcast/Atlantic BB).  I have included the running-config for the Connecticut site below.

From Connecticut, I can telnet to  the IL router, based on the nat forward I have added, I am

able to RDP to my workstation in IL.
From CT, I can telnet to both of the CT router Interface FA0/0 & 0/1.

From IL, I can ping CT router, but I can not Telnet to it. 

Other than that, both networks are working just fine from an operational perspective.
Email works, VPN to corp network works, my kids are able to stream multiple systems at the same time.
I am watching football through an RDP session from CT to IL, and sound and video is great.

Can you please review the run config below and maybe offer some insight as to what might be the issue?
Like I say, I have been working on this since Friday. I have been on this forum and several others.
I have reviewed over 150 documents . And while I have learned a lot about making small changes to improve overall function, I have not been able to fine anything that will help resolve this telnet connection thing.

Building configuration...

Current configuration : 2239 bytes
!
! Last configuration change at 10:07:06 EDT Sun Oct 22 2017
! NVRAM config last updated at 09:05:55 EDT Sun Oct 22 2017
!
version 12.2
service timestamps debug datetime msec
service timestamps log datetime msec
no service password-encryption
!
hostname CTDNLSN001
!
logging queue-limit 100
enable secret 5 $1$rSRO$O156CNXzcCNim8ZLW1urx.
enable password XXXXXXXX
!
clock timezone EASTERN -5
clock summer-time EDT recurring
ip subnet-zero
!
!
ip dhcp excluded-address 192.168.1.1 192.168.1.200
ip dhcp excluded-address 192.168.1.251 192.168.1.255
!
ip dhcp pool INSIDE-DHCP
network 192.168.1.0 255.255.255.0
default-router 192.168.1.2
dns-server 172.85.30.3 172.85.30.5
lease 30
!
ip cef
no ftp-server write-enable
!
!
!
!
interface FastEthernet0/0
ip address dhcp
ip nat outside
duplex auto
speed 100
!
interface FastEthernet0/1
description INSIDE-DHCO FA0/0
ip address 192.168.1.2 255.255.255.0
ip nat inside
duplex auto
speed 100
!
interface FastEthernet1/0
switchport priority override
no ip address
speed 100
!
interface FastEthernet1/1
no ip address
speed 100
!
interface FastEthernet1/2
no ip address
speed 100
!
interface FastEthernet1/3
no ip address
speed 100
!
interface FastEthernet1/4
no ip address
speed 100
!
interface FastEthernet1/5
no ip address
speed 100
!
interface FastEthernet1/6
no ip address
speed 100
!
interface FastEthernet1/7
no ip address
speed 100
!
interface FastEthernet1/8
no ip address
speed 100
!
interface FastEthernet1/9
no ip address
speed 100
!
interface FastEthernet1/10
no ip address
speed 100
!
interface FastEthernet1/11
no ip address
speed 100
!
interface FastEthernet1/12
no ip address
speed 100
!
interface FastEthernet1/13
no ip address
speed 100
!
interface FastEthernet1/14
no ip address
speed 100
!
interface FastEthernet1/15
no ip address
speed 100
!
interface Vlan1
no ip address
!
ip nat inside source list 1 interface FastEthernet0/0 overload
ip classless
!
ip http server
!
access-list 1 permit any
access-list 1 permit 192.168.1.0 0.0.0.255
!
line con 0
line aux 0
line vty 0 4
password XXXXXXX
login local
transport input pad telnet rlogin mop udptn v120
!
ntp clock-period 17180078
ntp server 129.6.15.28
!
!
end

+++++++++++++++++++++++++++++++++++++++++++++++++++++

Regards, 

Marty

[Flavio Miranda]

Hello @Mletendr1

 Can you enable debug on CTDNLSN001 and share the output here?

Just run the command "debug telnet"

[Mletendr1]

CTDNLSN001#debug telnet
Incoming Telnet debugging is on
CTDNLSN001#
Oct 23 00:04:14.140: Telnet66: 1 1 251 1
Oct 23 00:04:14.140: TCP66: Telnet sent WILL ECHO (1)
Oct 23 00:04:14.140: Telnet66: 2 2 251 3
Oct 23 00:04:14.144: TCP66: Telnet sent WILL SUPPRESS-GA (3)
Oct 23 00:04:14.144: Telnet66: 80000 80000 253 24
Oct 23 00:04:14.144: TCP66: Telnet sent DO TTY-TYPE (24)
Oct 23 00:04:14.144: Telnet66: 10000000 10000000 253 31
Oct 23 00:04:14.144: TCP66: Telnet sent DO WINDOW-SIZE (31)
Oct 23 00:04:14.156: TCP66: Telnet received WILL WINDOW-SIZE (31)
Oct 23 00:04:14.156: TCP66: Telnet received WILL TTY-SPEED (32) (refused)
Oct 23 00:04:14.156: TCP66: Telnet sent DONT TTY-SPEED (32)
Oct 23 00:04:14.160: TCP66: Telnet received WILL TTY-TYPE (24)
Oct 23 00:04:14.160: Telnet66: Sent SB 24 1
Oct 23 00:04:14.160: TCP66: Telnet received WILL NEW-ENVIRON (39)
Oct 23 00:04:14.164: TCP66: Telnet sent DONT NEW-ENVIRON (39) (unimplemented)
Oct 23 00:04:14.164: TCP66: Telnet received DO ECHO (1)
Oct 23 00:04:14.164: TCP66: Telnet received WILL SUPPRESS-GA (3)
Oct 23 00:04:14.164: TCP66: Telnet sent DO SUPPRESS-GA (3)
Oct 23 00:04:14.168: TCP66: Telnet received DO SUPPRESS-GA (3)
Oct 23 00:04:14.168: Telnet66: recv SB NAWS 80 24
Oct 23 00:04:14.168: Telnet66: recv SB 24 0 XTERM
Oct 23 00:04:14.168: TCP66: Telnet received WILL ENVIRONMENT (36) (refused)
Oct 23 00:04:14.172: TCP66: Telnet sent DONT ENVIRONMENT (36)

[Flavio Miranda]

Maybe logging is not enable. You can try the command 

Router#terminal monitor

[Mletendr1]

see above,.. I was able to get it to work

[Flavio Miranda]

What did you do ?

[Flavio Miranda]

We can see some "refused" on the log, although is not clear where it comes from.

Could you try to permit it?

ip access-list standard test

permit  "X.X.X.X" ( IL IP addresss)

Router(config)#line vty 0 4
Router(config-line)#access-class admin in

Also, if possible, share the config from the IL router as well.

[Mletendr1]

I was plugged into the wrong router.

[Mletendr1]

Below in green is the IL config

I also made the changes you suggested on CT here in blue

But still unable to telnet, and nothing appears on the debug.
So it looks like I am not getting in at all.

ip access-list standard test
permit 71.194.48.196
!
access-list 1 permit any
access-list 1 permit 192.168.1.0 0.0.0.255
!
line con 0
line aux 0
line vty 0 4
access-class admin in
password XXXXXXXX
login
transport input pad telnet rlogin mop udptn v120
!
ntp clock-period 17180126
ntp server 129.6.15.28
!
!
end

.

ILROUND001#Sho run
Building configuration...

Current configuration : 2861 bytes
!
! Last configuration change at 08:33:24 CDT Sun Oct 22 2017
! NVRAM config last updated at 08:33:29 CDT Sun Oct 22 2017
!
version 12.2
service timestamps debug datetime msec
service timestamps log datetime msec
no service password-encryption
!
hostname ILROUND001
!
boot system flash c2600-ipbase-mz.122-16.4.T
logging queue-limit 100
enable secret 5 $1$Mm34$rnE/ek9NZuzUIw1xCVhq3.
enable password XXXXXXX
!
clock timezone CENTRAL -6
clock summer-time CDT recurring
ip subnet-zero
!
!
ip dhcp excluded-address 192.168.1.1 192.168.1.200
ip dhcp excluded-address 192.168.1.251 192.168.1.254
ip dhcp excluded-address 192.168.1.255
!
ip dhcp pool INSIDE-DHCP
network 192.168.1.0 255.255.255.0
default-router 192.168.1.2
dns-server 75.75.75.75 75.75.76.76
lease 30
!
ip cef
no ip domain lookup
no ftp-server write-enable
!
!
!
!
interface FastEthernet0/0
description COMCAST Assigned FA0/0
ip address dhcp
ip nat outside
duplex auto
speed 100
!
interface FastEthernet0/1
description INTERNAL DHCP FA0/1
ip address 192.168.1.2 255.255.255.0
ip nat inside
duplex auto
speed 100
!
interface FastEthernet1/0
description BRIDGE-SWTCH-RTR-FA1/0
switchport priority override
no ip address
speed 100
!
interface FastEthernet1/1
description MERAKI-WiFi-F1/1
no ip address
speed 100
!
interface FastEthernet1/2
description NM-16ESW-1/2
no ip address
speed 100
!
interface FastEthernet1/3
description NM-16ESW-1/3
no ip address
!
interface FastEthernet1/4
description NM-16ESW-1/4
no ip address
!
interface FastEthernet1/5
description NM-16ESW-1/5
no ip address
!
interface FastEthernet1/6
description NM-16ESW-1/6
no ip address
!
interface FastEthernet1/7
description NM-16ESW-1/7
no ip address
!
interface FastEthernet1/8
description NM-16ESW-1/8
no ip address
speed 100
!
interface FastEthernet1/9
description NM-16ESW-1/9
no ip address
!
interface FastEthernet1/10
description NM-16ESW-1/10
no ip address
!
interface FastEthernet1/11
description NM-16ESW-1/11
no ip address
!
interface FastEthernet1/12
description NM-16ESW-1/12
no ip address
!
interface FastEthernet1/13
description NM-16ESW-1/13
no ip address
!
interface FastEthernet1/14
description NM-16ESW-1/14
no ip address
!
interface FastEthernet1/15
description NM-16ESW-1/15
no ip address
!
interface Vlan1
no ip address
!
ip nat inside source list 1 interface FastEthernet0/0 overload
ip nat inside source static tcp 192.168.1.199 3389 71.194.48.196 3389 extendable
ip nat inside source static tcp 192.168.1.198 3390 71.194.48.196 3390 extendable
ip classless
!
ip http server
!
access-list 1 permit any
snmp-server community ilround-community RO
snmp-server community ilround-Private RW
snmp-server enable traps tty
!
line con 0
line aux 0
line vty 0 4
password XXXXXXXX
login
!
ntp clock-period 17181038
ntp server 129.6.15.28
!
!
end

++++++++++++++++++++++++++++++++++++++++++++++++++

[Flavio Miranda]

I induced you to make a mistake.

The proper command is:

access-class test in

Please,try  again.

There's a difference between both router on vty config:

IL:

line vty 0 4
password XXXXXXXX
login
!

CT:

line vty 0 4
access-class admin in
password XXXXXXXX
login
transport input pad telnet rlogin mop udptn v120

You don't have transport input pad telnet mop udptn v120 on IL.

Usually we use transport input all.

-If I helped you somehow, please, rate it as useful.-

[Mletendr1]

made the changes as you suggested. still no change.

Also note: Under LINE VTY 04, 

I did type in transport input all, but the output it shows is 

transport input pad telnet rlogin mop udptn v120

If I type in just telnet, , hen it shows up the same. But when I type "all", 

That is what I get 

[Mletendr1]

Also, the reason why the 2 configs are different is because of the trouble I ma having.

They both started out identical

[Mletendr1]

calling it a night. 
I have to be up at 4:30 am tomorrow.
Thanks again for all your help and insight.
I will check back tomorrow afternoon

[Flavio Miranda]

Alright....I'll think in something different.

[Mletendr1]

I am still having the same issue.
I have rebuilt the router twice, still cant telnet.
output from a "Sho ip route" command.
My IP address for my internet facing port is: 206.53.69.208/22

But if I am reading this route below, I am on a different subnet

than the one listed in the table below.

Thoughts?

I have attached the configs from both routers as they are today. I did not add all the additional access statements like yesterday. If the IL site is working as it is, then GT should work too. 

CTDNLSN001#sho ip route
Codes: C - connected, S - static, R - RIP, M - mobile, B - BGP
D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area
N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
E1 - OSPF external type 1, E2 - OSPF external type 2
i - IS-IS, L1 - IS-IS level-1, L2 - IS-IS level-2, ia - IS-IS inter area
* - candidate default, U - per-user static route, o - ODR
P - periodic downloaded static route

Gateway of last resort is 206.53.68.1 to network 0.0.0.0

C 192.168.1.0/24 is directly connected, FastEthernet0/1
S* 0.0.0.0/0 [254/0] via 206.53.68.1
C 206.53.68.0/22 is directly connected, FastEthernet0/0
CTDNLSN001#