Personal 501 and configuration

[admin_2]

Connection is SBC DSL service via PPPoE connection, I play an online game called Everquest. According to thier tech people this is what I need to configure the firewall to get acces for the 4 computers that are connected to the 501.

-

A TCP connection is initiated from the player's PC (using ports numbered >1023) to patch.everquest.com, port 7000. There are multiple IP addresses for the patch.everquest.com clusters, and they may change as the network demands, so check often using a DNS lookup tool if you provide a specific firewall rule for patching.

EverQuest client:

UDP datagrams are sent to/from the player's PC (using ports numbered >1023) from/to the EverQuest servers (using ports numbered >1023). Additionally, ICMP Unreachables (ICMP type 3) are sent to/from the player's PC from/to the EverQuest servers.

The EverQuest server IP addresses are on the subnets:

64.37.148.* , 64.37.149.* , 64.37.150.* , 64.37.151.* , 64.37.156.* , 64.37.157.* , 195.33.132.*, 195.33.108.*, 195.33.133.*, 199.108.1.*, 199.108.2*, 199.108.3.* 199.108.4*, 199.108.5*, 199.108.13*

Please note that EverQuest opens a random UDP data port from the player's PC every time EverQuest is run. Thus, the need to have all ports >1023 available.

Continues in another message due to size

[#2]

Current Config

PIX Version 6.3(1)

interface ethernet0 auto

interface ethernet1 100full

nameif ethernet0 outside security0

nameif ethernet1 inside security100

hostname pixfirewall

domain-name ciscopix.com

clock timezone CST -6

clock summer-time CDT recurring

fixup protocol ftp 21

fixup protocol h323 h225 1720

fixup protocol h323 ras 1718-1719

fixup protocol http 80

fixup protocol ils 389

fixup protocol rsh 514

fixup protocol rtsp 554

fixup protocol sip 5060

fixup protocol sip udp 5060

fixup protocol skinny 2000

fixup protocol smtp 25

fixup protocol sqlnet 1521

names

object-group service EQPatch tcp

description EQ Patch Server

port-object range 7000 7000

object-group service EQLogChat1 udp

description EQ login/chat server 1

port-object range 5998 5998

port-object range 5999 5999

object-group service EQLogChat2 udp

description EQ login Chat Server 2

port-object range 5998 5998

port-object range 15900 15900

object-group service EQLogChat3 udp

description Login/Chat Server 3

port-object range 5998 5998

port-object range 15901 15901

object-group service EQLogChat4 udp

description Login/Chat4

port-object range 5998 5998

port-object range 15902 15902

object-group service EQLogChat5 udp

description Login/Cagt 5

port-object range 5998 5998

port-object range 15903 15903

object-group service WorldServers udp

description Actaull Game Servers

port-object range 1024 65535

port-object range 9000 9000

object-group service EQIM1 udp

description Instant Messanger 1

port-object range 4003 4003

object-group service EQIM2 udp

description Instant Messenger 2

port-object range 9876 9876

access-list inside_access_in remark Everquest ICMP Unreachable

access-list inside_access_in permit icmp any any unreachable

access-list inside_access_in remark ACL for Patch Server

access-list inside_access_in permit tcp any object-group EQPatch any

access-list inside_access_in remark ACL for login Server 1

access-list inside_access_in permit udp any object-group EQLogChat1 any

access-list inside_access_in remark ACL for login/chat Server 1

access-list inside_access_in permit udp any object-group EQLogChat2 any

access-list inside_access_in remark ACL for Login/Chat Server 2

access-list inside_access_in permit udp any object-group EQLogChat3 any

access-list inside_access_in remark ACL for Login/Chat Server 3

access-list inside_access_in permit udp any object-group EQLogChat4 any

access-list inside_access_in remark ACL for Login/Chat Server 4

access-list inside_access_in permit udp any object-group EQLogChat5 any

access-list inside_access_in remark ACL for Login/Chat server 5

access-list inside_access_in permit udp any object-group WorldServers any

access-list inside_access_in remark ACL for World Servers

access-list inside_access_in permit udp any object-group EQIM1 any

access-list inside_access_in remark ACL for message server 1

access-list inside_access_in permit udp any object-group EQIM2 any

access-list inside_access_in remark ACL for message server 2

See next message for rest of confiuration file and questions

[#3]

pager lines 24

mtu outside 1500

mtu inside 1500

ip address outside pppoe setroute

ip address inside 192.168.1.1 255.255.255.0

ip audit info action alarm

ip audit attack action alarm

pdm logging informational 100

pdm history enable

arp timeout 14400

global (outside) 1 192.168.1.2-192.168.1.32

nat (inside) 1 0.0.0.0 0.0.0.0 0 0

access-group inside_access_in in interface inside

timeout xlate 0:05:00

timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 rpc 0:10:00 h225 1:00:00

timeout h323 0:05:00 mgcp 0:05:00 sip 0:30:00 sip_media 0:02:00

timeout uauth 0:05:00 absolute

aaa-server TACACS+ protocol tacacs+

aaa-server RADIUS protocol radius

aaa-server LOCAL protocol local

http server enable

http 192.168.1.0 255.255.255.0 inside

no snmp-server location

no snmp-server contact

snmp-server community public

no snmp-server enable traps

floodguard enable

telnet timeout 5

ssh timeout 5

console timeout 0

vpdn group pppoe_group request dialout pppoe

dhcpd address 192.168.1.2-192.168.1.33 inside

dhcpd lease 86400

dhcpd ping_timeout 750

dhcpd auto_config outside

dhcpd enable inside

terminal width 80

: end

Questions are this:

1 - Will this configuration work as it stands?

2 - Is there anyway to restict access to only the addresses listed for the servers?

3 - I would like to restrict incoming pings and tracerts to my equipment that is located behind the 501, but allow them outbound from any device How is this accomplished?

As I said, I have multiple machines attached to the 501 that need concurrent access to the game.

Would really like to get this up and running and would appreciate any and all assistance in this