2

I have an OpenVPN Ubuntu Server working on ip 192.168.1.11

I need to let my roadwarriors use it from anywhere. I have a Cisco 800 router but I'm not an expert... I've downloaded using tftp its running config

copy running-config tftp

and I'm editing it with notepad++

I think that I should add:

ip nat inside source static tcp 192.168.1.11 1194 mypublicip 1194 extendable

is this all? Then I should just restore this modified config and I'm done? Should I also add a permissive rule on the firewall config (always cisco 800)?

Cisco manuals suggest me to delete all rows in my config contaning "AAA" I just have: no aaa new-model should I keep it? I'm reading that those "aaa" commands could lock me out of the router :/

Thanks.

5
  • 1
    You probably want to say "udp" instead of "tcp", unless you have a non-standard OpenVPN configuration. OpenVPN, by default, will use udp.
    – cjc
    Dec 30, 2011 at 11:14
  • 1
    Why not configure the Cisco 800 to be the VPN endpoint instead of OpenVPN? Dec 30, 2011 at 11:45
  • Great suggestion, cjc! I'm doing it right away... Tom if I could do that I wouldn't be asking such a "simple" question. Your idea is good anyway: I'll check how to do that :)
    – Pitto
    Dec 30, 2011 at 11:55
  • ps Cisco manuals suggest me to delete all rows in my config contaning "AAA" I just have: no aaa new-model should I keep it?
    – Pitto
    Dec 30, 2011 at 11:58
  • I'm reading horrible things about this aaa command: maybe it could lock me out of the router :/
    – Pitto
    Dec 30, 2011 at 12:04

1 Answer 1

2

no aaa new-model is fine if you don't have any dialin or vpn configured on this router.

Regarding your NAT/PAT issue, your statement should be OK if you are indeed using openvpn over TCP.

The other solution would be to set up a static nat redirection for all ports (what consumer routers call 'DMZ'):

Router(config)#ip nat inside source static 192.168.1.11 <publicIp>
5
  • wouldn't it be better to delete this no aaa new-model row just to be sure?
    – Pitto
    Dec 30, 2011 at 13:33
  • I've tried my config but it is not working, probably because I neet to implement also a firewall rule...
    – Pitto
    Dec 30, 2011 at 13:51
  • @Pitto: deleting no aaa new-model means configuring AAA by typing aaa new-model. This can work, but can be difficult to set up for someone without cisco knowledge.
    – petrus
    Dec 30, 2011 at 14:20
  • @Pitto: firewall rule? Why would you want that? Is the NAT (or PAT) already working outbound on the Cisco for other clients?
    – petrus
    Dec 30, 2011 at 14:21
  • Firewall router was really useless: you're right... The config is working perfectly now :) I just had problems because I thought that checking cisco's ports with nmap would've given me data about port 1194 but it didn't so I assumed it was not working (even if it was :) )
    – Pitto
    Jan 2, 2012 at 8:07

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .