up vote 2 down vote favorite
share [g+] share [fb]

I have an OpenVPN Ubuntu Server working on ip 192.168.1.11

I need to let my roadwarriors use it from anywhere. I have a Cisco 800 router but I'm not an expert... I've downloaded using tftp its running config

copy running-config tftp

and I'm editing it with notepad++

I think that I should add:

ip nat inside source static tcp 192.168.1.11 1194 mypublicip 1194 extendable

is this all? Then I should just restore this modified config and I'm done? Should I also add a permissive rule on the firewall config (always cisco 800)?

Cisco manuals suggest me to delete all rows in my config contaning "AAA" I just have: no aaa new-model should I keep it? I'm reading that those "aaa" commands could lock me out of the router :/

Thanks.

link|improve this question
81% accept rate
1  
You probably want to say "udp" instead of "tcp", unless you have a non-standard OpenVPN configuration. OpenVPN, by default, will use udp. – cjc Dec 30 '11 at 11:14
1  
Why not configure the Cisco 800 to be the VPN endpoint instead of OpenVPN? – Tom O'Connor Dec 30 '11 at 11:45
Great suggestion, cjc! I'm doing it right away... Tom if I could do that I wouldn't be asking such a "simple" question. Your idea is good anyway: I'll check how to do that :) – Pitto Dec 30 '11 at 11:55
ps Cisco manuals suggest me to delete all rows in my config contaning "AAA" I just have: no aaa new-model should I keep it? – Pitto Dec 30 '11 at 11:58
I'm reading horrible things about this aaa command: maybe it could lock me out of the router :/ – Pitto Dec 30 '11 at 12:04
feedback

1 Answer

up vote 2 down vote accepted

no aaa new-model is fine if you don't have any dialin or vpn configured on this router.

Regarding your NAT/PAT issue, your statement should be OK if you are indeed using openvpn over TCP.

The other solution would be to set up a static nat redirection for all ports (what consumer routers call 'DMZ'): 

Router(config)#ip nat inside source static 192.168.1.11 <publicIp>
link|improve this answer
wouldn't it be better to delete this no aaa new-model row just to be sure? – Pitto Dec 30 '11 at 13:33
I've tried my config but it is not working, probably because I neet to implement also a firewall rule... – Pitto Dec 30 '11 at 13:51
@Pitto: deleting no aaa new-model means configuring AAA by typing aaa new-model. This can work, but can be difficult to set up for someone without cisco knowledge. – petrus Dec 30 '11 at 14:20
@Pitto: firewall rule? Why would you want that? Is the NAT (or PAT) already working outbound on the Cisco for other clients? – petrus Dec 30 '11 at 14:21
Firewall router was really useless: you're right... The config is working perfectly now :) I just had problems because I thought that checking cisco's ports with nmap would've given me data about port 1194 but it didn't so I assumed it was not working (even if it was :) ) – Pitto Jan 2 at 8:07
feedback

Your Answer

 
or
required, but never shown
discard

Not the answer you're looking for? Browse other questions tagged or ask your own question.