0

I am trying to configure a Cisco 887VA at work to open port 110, but no matter what I try, it doesn't seem to work.

The router is accessed from within the building via a web UI but require CLI commands to get it to do anything. I have done a fair amount of research and believe the code I require is :-

ip nat inside source static tcp [internal IP address of our mail server] 110 [external IP address] 110

I've entered this information into the router and it's showing when I run a show run command, but when I ping port 110 via a free online port scanner the port is still showing as closed.

I have noticed further down the show run report that for most of the other port forwarding entries there are corresponding permit entries, and I don't know whether this may have something to do with it.

The router was supplied by our ISP but they have said it will take them 15 WORKING days to send an engineer around at a cost, and we just can't afford to wait that long so I'm kinda fighting my way through it blind at the moment.

Any help anybody can provide would be MOST gratefully received.

** EDIT, PARTIALLY REDACTED AFTER FINAL ANSWER SO AS TO LEAVE JUST THAT INFORMATION WHICH MAY BE OF USE TO SUBSEQUENT SITE VISITORS **

Here is the syntax of the latest report :-

ip nat inside source route-map NATTING interface Dialer1 overload
ip nat inside source static tcp 192.168.10.21 25 212.9.28.216 25 extendable
ip nat inside source static tcp 192.168.10.21 80 212.9.28.216 80 extendable
ip nat inside source static tcp 192.168.10.21 88 212.9.28.216 88 extendable
ip nat inside source static udp 192.168.10.21 88 212.9.28.216 88 extendable
ip nat inside source static tcp 192.168.10.21 110 212.9.28.216 110 extendable
ip nat inside source static tcp 192.168.10.21 143 212.9.28.216 143 extendable
ip nat inside source static tcp 192.168.10.21 443 212.9.28.216 443 extendable
ip nat inside source static tcp 192.168.10.21 993 212.9.28.216 993 extendable
ip nat inside source static tcp 192.168.10.24 3389 212.9.28.216 3385 extendable
ip nat inside source static tcp 192.168.10.22 3389 212.9.28.216 3389 extendable
ip nat inside source static tcp 192.168.10.25 5900 212.9.28.216 5900 extendable
ip nat inside source static tcp 192.168.10.1 80 212.9.28.216 8080 extendable
ip nat inside source static tcp 192.168.10.20 20035 212.9.28.216 20035 extendable
ip route 0.0.0.0 0.0.0.0 Dialer1
!
ip access-list extended INBOUND
deny ip host 0.0.0.0 any log
deny ip 10.0.0.0 0.255.255.255 any log
deny ip 127.0.0.0 0.255.255.255 any log
deny ip 172.16.0.0 0.15.255.255 any log
deny ip 192.168.0.0 0.0.255.255 any log
deny ip 224.0.0.0 31.255.255.255 any log
deny ip host 255.255.255.255 any log
permit tcp any host 212.9.28.216 eq smtp
permit tcp any host 212.9.28.216 eq 443
permit tcp any host 212.9.28.216 eq 88
permit tcp any host 212.9.28.216 eq 8080
permit udp any eq 88 host 212.9.28.216
permit tcp any host 212.9.28.216 eq 143
permit tcp any host 212.9.28.216 eq 993
permit tcp any host 212.9.28.216 eq www
permit tcp any host 212.9.28.216 eq 20035
permit tcp any host 212.9.28.216 eq 3389
permit tcp any host 212.9.28.216 eq 3385
permit tcp any host 212.9.28.216 eq 5900
permit udp host 212.9.0.135 eq domain host 212.9.28.216
permit udp host 212.9.0.136 eq domain host 212.9.28.216
permit udp 130.88.0.0 0.0.255.255 eq ntp host 212.9.28.216
permit icmp any any echo-reply
permit icmp any any time-exceeded
permit tcp 212.9.0.0 0.0.0.255 host 212.9.28.216 eq 22
permit tcp 212.9.0.0 0.0.0.255 host 212.9.28.216 eq telnet
permit icmp 212.9.0.0 0.0.0.255 host 212.9.28.216 echo
permit tcp host 212.9.19.91 host 212.9.28.216 eq telnet
permit tcp host 212.9.19.91 host 212.9.28.216 eq 22
permit icmp host 212.9.19.91 host 212.9.28.216 echo
ip access-list extended NAT-TRAFFIC
permit ip 192.168.10.0 0.0.0.255 any
!

Improve this question
6
  • Well, the task is simple, but I need the config to look into. You probably forgot to indicate the inside and outside interfaces.
    – drookie
    Oct 18, 2014 at 4:58
  • ip nat inside source route-map NATTING interface Dialer1 overload ip nat inside source static tcp 192.168.10.21 25 212.9.28.216 25 extendable ip nat inside source static tcp 192.168.10.21 80 212.9.28.216 80 extendable ip nat inside source static tcp 192.168.10.21 88 212.9.28.216 88 extendable ip nat inside source static udp 192.168.10.21 88 212.9.28.216 88 extendable ip nat inside source static tcp 192.168.10.21 110 212.9.28.216 110 extendable ip nat inside source static tcp 192.168.10.21 143 212.9.28.216 143 extendable
    – David
    Oct 18, 2014 at 14:16
  • I just successfully posted the code, but the moderator deleted and I've no idea why :(
    – David
    Oct 18, 2014 at 14:40
  • Answers are intended solely for answers to the question. Updates to your question should be edited into the question. (Oh, and you should also register your account.)
    – Michael Hampton
    Oct 18, 2014 at 14:43
  • Got it, thanks Michael - I didn't think I could edit the OP, and I couldn't post it as a comment since it wouldn't recognise the syntax so I figured my only option was to post it as an 'answer' which, obviously, it isn't. I'll register my account now, thanks.
    – David
    Oct 18, 2014 at 15:49

2 Answers 2

Reset to default
1

The NAT entry you added looks correct, now you need to allow that traffic through your INBOUND ACL.

Since it is an extended ACL you can edit it directly:

ip access-list extended INBOUND
permit tcp any host 212.9.28.216 eq 110
Improve this answer
1
  • That is ABSOLUTELY magic, thank you so so so so much !! Eugene thank you also for your help, but cpt_fink's answer was spot on as I literally just had to type it in and BOOM, port 110 is now open. You guys are just the best. Thank you thank you thank you !!!!!!!
    – David
    Oct 18, 2014 at 23:22
0

you don't have to use route-map. you have to mark your interfaces ip inside and ip outside accordingly, create a ip access-list for NAT and modify the ip nat statement.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .