0

I've been tasked with setting up port forwarding for access to remote desktop on a server. I'm having trouble making it work.

Server IP 192.168.1.20, port 3389

The router is a Cisco SR520. It is behind our ISP's modem, which has an IP of 192.168.5.1. Their modem's NAT should be sending incoming connections to 192.168.5.100 (which is the router's IP for that interface, FastEthernet4).

We do have a couple VLANs, the server is on VLAN 1.

I'm not much of a network guy, just dipping my feet in. I believe the NAT is configured to forward the port correctly, and I added access-list rules to allow it. There's also some zone security, which I'm not sure about however. Does this look correct? Did I miss something?

ip source-route
!
!
ip dhcp excluded-address 192.168.75.1 192.168.75.10
ip dhcp excluded-address 192.168.1.1 192.168.1.64
ip dhcp excluded-address 192.168.10.1 192.168.10.64
ip dhcp excluded-address 192.168.20.1 192.168.20.64
!
ip dhcp pool inside
   import all
   network 192.168.75.0 255.255.255.0
   default-router 192.168.75.1
!
ip dhcp pool dpool1
   import all
   network 192.168.1.0 255.255.255.0
   default-router 192.168.1.1
   domain-name midwaybc.org
   dns-server 38.65.70.4 38.65.70.5
!
ip dhcp pool dpool10
   import all
   network 192.168.10.0 255.255.255.0
   default-router 192.168.10.1
   domain-name midwaybc.org
   dns-server 38.65.70.4 38.65.70.5
!
ip dhcp pool dpool20
   import all
   network 192.168.20.0 255.255.255.0
   default-router 192.168.20.1
   domain-name midwaybc.org
   dns-server 38.65.70.4 38.65.70.5
!
!
ip cef
no ip domain lookup
ip domain name Midwaybc.org
ip name-server 38.65.70.4
ip name-server 38.65.70.5
!
no ipv6 cef
multilink bundle-name authenticated
!
!
username cisco privilege 15 secret 5 {REMOVED}
!
!
!
archive
 log config
  logging enable
  logging size 600
  hidekeys
!
!
!
class-map type inspect match-any SDM-Voice-permit
 match protocol h323
 match protocol skinny
 match protocol sip
class-map type inspect match-any sdm-cls-icmp-access
 match protocol icmp
 match protocol tcp
 match protocol udp
class-map type inspect match-any sdm-cls-insp-traffic
 match protocol cuseeme
 match protocol dns
 match protocol ftp
 match protocol h323
 match protocol https
 match protocol icmp
 match protocol imap
 match protocol pop3
 match protocol netshow
 match protocol shell
 match protocol realmedia
 match protocol rtsp
 match protocol smtp extended
 match protocol sql-net
 match protocol streamworks
 match protocol tftp
 match protocol vdolive
 match protocol tcp
 match protocol udp
class-map type inspect match-all sdm-invalid-src
 match access-group 100
class-map type inspect match-all sdm-protocol-http
 match protocol http
!
!
policy-map type inspect sdm-permit-icmpreply
 class type inspect sdm-cls-icmp-access
  inspect
 class class-default
  pass
policy-map type inspect sdm-inspect
 class type inspect sdm-invalid-src
  drop log
 class type inspect sdm-cls-insp-traffic
  inspect
 class type inspect sdm-protocol-http
  inspect
 class type inspect SDM-Voice-permit
  pass
 class class-default
  pass
policy-map type inspect sdm-inspect-voip-in
 class type inspect SDM-Voice-permit
  pass
 class class-default
  drop
policy-map type inspect sdm-permit
 class class-default
  drop
!
zone security out-zone
zone security in-zone
zone-pair security sdm-zp-self-out source self destination out-zone
 service-policy type inspect sdm-permit-icmpreply
zone-pair security sdm-zp-out-self source out-zone destination self
 service-policy type inspect sdm-permit
zone-pair security sdm-zp-in-out source in-zone destination out-zone
 service-policy type inspect sdm-inspect
zone-pair security sdm-zp-out-in source out-zone destination in-zone
 service-policy type inspect sdm-inspect-voip-in
!
!
!
interface Loopback0
 ip address 10.108.1.1 255.255.255.0
!
interface FastEthernet0
 switchport mode trunk
!
interface FastEthernet1
 switchport access vlan 10
!
interface FastEthernet2
 switchport access vlan 10
!
interface FastEthernet3
!
interface FastEthernet4
 description $FW_OUTSIDE$
 ip address 192.168.5.100 255.255.255.0
 ip nat outside
 ip virtual-reassembly
 zone-member security out-zone
 duplex auto
 speed auto
!
interface Vlan1
 ip address 192.168.1.1 255.255.255.0
 ip nat inside
 ip virtual-reassembly
 zone-member security in-zone
!
interface Vlan10
 description $FW_INSIDE$
 ip address 192.168.10.1 255.255.255.0
 ip nat inside
 ip virtual-reassembly
!
interface Vlan20
 description $FW_INSIDE$
 ip address 192.168.20.1 255.255.255.0
 ip access-group 130 in
 ip nat inside
 ip virtual-reassembly
 zone-member security in-zone
!
interface Vlan75
 description $FW_INSIDE$
 ip address 192.168.75.1 255.255.255.0
 ip nat inside
 ip virtual-reassembly
 zone-member security in-zone
!
router rip
 version 2
 network 192.168.1.0
 network 192.168.10.0
 network 192.168.20.0
 no auto-summary
!
ip forward-protocol nd
ip route 0.0.0.0 0.0.0.0 192.168.5.1
ip route 192.168.1.0 255.255.255.0 172.17.14.1
ip route 192.168.10.0 255.255.255.0 172.17.14.1
ip route 192.168.20.0 255.255.255.0 172.17.14.1
!
ip http server
ip http authentication local
ip http secure-server
ip http timeout-policy idle 60 life 86400 requests 10000
ip nat inside source list 1 interface FastEthernet4 overload
ip nat inside source static tcp 192.168.10.2 5060 interface FastEthernet4 5060
ip nat inside source static udp 192.168.10.2 5060 interface FastEthernet4 5060
ip nat inside source static tcp 192.168.10.2 1720 interface FastEthernet4 1720
ip nat inside source static tcp 192.168.1.20 3389 38.65.74.164 3389 extendable
ip nat inside source static tcp 192.168.1.20 3389 192.168.5.100 3389 extendable
!
access-list 1 remark SDM_ACL Category=2
access-list 1 permit 192.168.75.0 0.0.0.255
access-list 1 permit 192.168.10.0 0.0.0.255
access-list 1 permit 10.1.1.0 0.0.0.255
access-list 1 permit 192.168.1.0 0.0.0.255
access-list 1 permit 192.168.20.0 0.0.0.255
access-list 100 permit udp any host 192.168.1.20 eq 3389
access-list 100 permit tcp any host 192.168.1.20 eq 3389
access-list 100 remark SDM_ACL Category=128
access-list 100 permit ip host 255.255.255.255 any
access-list 100 permit ip 127.0.0.0 0.255.255.255 any
access-list 130 deny   ip 192.168.20.0 0.0.0.255 192.168.0.0 0.0.255.255
access-list 130 permit ip any any
!
!
!
!
!
control-plane
!
banner login ^C{REMOVED}^C
!
line con 0
 password 7 {REMOVED}
 no modem enable
line aux 0
line vty 0 4
 password 7 {REMOVED}
 transport input telnet ssh
!
scheduler max-task-time 5000
ntp server 132.163.4.101 prefer
end
0

I figured it out, the issue was with the zone based firewall.

All I needed was the NAT rule, plus to modify the firewall to allow specific incoming ports.

I found this article very useful and explained everything needed for zone-based port forwarding.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.