Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I am configuring a Cisco 877 router in a test environment. We use a non-standard port for SFTP, 3030. On my inbound ACL I am setting permit tcp any any eq 3030 but the remote SFTP connection is being refused.

We use a non-standard port for SQL too, and this is set on the same ACL, but works fine. When I do sh access-list it doesn't show any matches for the SFTP rule at all, unless I attempt a port probe. All other ACL rules work fine.

What am I missing to allow through this connection? I've even tried to set port-map SSH 3030, as this is the protocol used once a connection has been established, to no avail.

share|improve this question
1  
If the port probe works but the sftp client does not, try capturing the packets on the client with tcpdump/wireshark and look at what's happening. There's maybe something wrong with the client. –  petrus Aug 16 '12 at 16:26
    
I'm pretty sure it's not the app. I'm trying the SFTP from within the network, and it's fine. Trying the same thing (using filezilla) outside the network is not working, and it's not getting through the firewall. –  kafka Aug 16 '12 at 17:10
    
Yeah but capturing the packets might gives you clues about why it's failing. –  petrus Aug 16 '12 at 17:54
    
OK cool ill give that a go –  kafka Aug 16 '12 at 19:26
add comment

1 Answer

up vote 0 down vote accepted

Thanks to petrus above. I was testing external connectivity from our web server. I used Wireshark to determine that it was in fact the web server's firewall which wasn't allowing the connection out. Have now successfully proved that our firewall will allow connections in as desired.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.