Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have an OpenVPN Ubuntu Server working on ip

I need to let my roadwarriors use it from anywhere. I have a Cisco 800 router but I'm not an expert... I've downloaded using tftp its running config

copy running-config tftp

and I'm editing it with notepad++

I think that I should add:

ip nat inside source static tcp 1194 mypublicip 1194 extendable

is this all? Then I should just restore this modified config and I'm done? Should I also add a permissive rule on the firewall config (always cisco 800)?

Cisco manuals suggest me to delete all rows in my config contaning "AAA" I just have: no aaa new-model should I keep it? I'm reading that those "aaa" commands could lock me out of the router :/


share|improve this question
You probably want to say "udp" instead of "tcp", unless you have a non-standard OpenVPN configuration. OpenVPN, by default, will use udp. – cjc Dec 30 '11 at 11:14
Why not configure the Cisco 800 to be the VPN endpoint instead of OpenVPN? – Tom O'Connor Dec 30 '11 at 11:45
Great suggestion, cjc! I'm doing it right away... Tom if I could do that I wouldn't be asking such a "simple" question. Your idea is good anyway: I'll check how to do that :) – Pitto Dec 30 '11 at 11:55
ps Cisco manuals suggest me to delete all rows in my config contaning "AAA" I just have: no aaa new-model should I keep it? – Pitto Dec 30 '11 at 11:58
I'm reading horrible things about this aaa command: maybe it could lock me out of the router :/ – Pitto Dec 30 '11 at 12:04
up vote 2 down vote accepted

no aaa new-model is fine if you don't have any dialin or vpn configured on this router.

Regarding your NAT/PAT issue, your statement should be OK if you are indeed using openvpn over TCP.

The other solution would be to set up a static nat redirection for all ports (what consumer routers call 'DMZ'):

Router(config)#ip nat inside source static <publicIp>
share|improve this answer
wouldn't it be better to delete this no aaa new-model row just to be sure? – Pitto Dec 30 '11 at 13:33
I've tried my config but it is not working, probably because I neet to implement also a firewall rule... – Pitto Dec 30 '11 at 13:51
@Pitto: deleting no aaa new-model means configuring AAA by typing aaa new-model. This can work, but can be difficult to set up for someone without cisco knowledge. – petrus Dec 30 '11 at 14:20
@Pitto: firewall rule? Why would you want that? Is the NAT (or PAT) already working outbound on the Cisco for other clients? – petrus Dec 30 '11 at 14:21
Firewall router was really useless: you're right... The config is working perfectly now :) I just had problems because I thought that checking cisco's ports with nmap would've given me data about port 1194 but it didn't so I assumed it was not working (even if it was :) ) – Pitto Jan 2 '12 at 8:07

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.