1

I have configured PNAT on my router. Everything seems fine. I have static NAT set for port forwarding for servers behind the NAT router.

I have setup ACLs to open the ports that are being forwarded on the Ext. Interface

but when I do a port scan, only ssh is open, the rest of the ports are closed.

Does any one have an idea as to why this is so? Thx

Conf:

service timestamps debug datetime msec
service timestamps log datetime msec
service password-encryption
!
hostname OME-GW
!
boot-start-marker
boot-end-marker
!
!
no aaa new-model
!
!
!
dot11 syslog
ip source-route
!
!
!
!
ip cef
no ip bootp server
ip domain name *******
ip name-server [x.x.x.x]
ip name-server [x.x.x.x]
ip name-server 8.8.8.8
ip name-server 8.8.4.4
no ipv6 cef
!
multilink bundle-name authenticated
!
!
!
!
!
license udi pid CISCO1841 sn XXXXXXX

!
redundancy
!
!
ip ssh port 22 rotary 1
!
class-map match-all win_kasp_updates_allow
 match protocol http url "/.geo.kaspersky.com"
 match protocol http url "/.windowsupdate.com"
 match protocol http url "/update.windows.com"
 match protocol http url "/windowsupdate.microsoft.com"
 match protocol http url "/downloads4.kaspersky-labs.com"
 match access-group 10
class-map match-all everything_else
 match any
!
!
policy-map win_kasp_updates_allow_policy
 class win_kasp_updates_allow
   drop
 class everything_else
!
!
!
!
!
!
!
!
interface FastEthernet0/0
 ip address 192.168.1.21 255.255.255.0
 ip access-group 103 in
 ip flow ingress
 ip flow egress
 ip nat inside
 ip virtual-reassembly
 duplex auto
 speed auto
 !
 service-policy input win_kasp_updates_allow_policy
!
interface FastEthernet0/1
 ip address [Public_IP] 255.255.255.252
 ip access-group 102 in
 ip nat outside
 ip virtual-reassembly
 duplex auto
 speed auto
 !
!
interface Serial0/1/0
 no ip address
 shutdown
 no fair-queue
 clock rate 2000000
 !
!
interface Serial0/1/1
 no ip address
 shutdown
 clock rate 2000000
 !
!
ip default-gateway [ISP_P2P_IP]
ip forward-protocol nd
no ip http server
no ip http secure-server
!
ip flow-export version 5
ip flow-export destination 192.168.1.151 9991
ip flow-top-talkers
 top 10
 sort-by bytes
!
ip dns server
ip nat inside source list 1 interface FastEthernet0/1 overload
ip nat inside source static tcp 192.168.1.20 25 [Public_IP] 25 extendable
ip nat inside source static tcp 192.168.1.20 25 [Public_IP] 26 extendable
ip nat inside source static tcp 192.168.1.20 53 [Public_IP] 53 extendable
ip nat inside source static udp 192.168.1.20 53 [Public_IP] 53 extendable
ip nat inside source static tcp 192.168.1.20 110 [Public_IP] 110 extendable
ip nat inside source static udp 192.168.1.20 1194 [Public_IP] 1194 extendable
ip route 0.0.0.0 0.0.0.0 [ISP_P2P_IP]
!
access-list 1 permit 192.168.1.0 0.0.0.255
access-list 10 deny   192.168.1.22
access-list 10 permit 192.168.1.0 0.0.0.255
access-list 102 permit tcp any any eq pop3
access-list 102 permit tcp any any eq smtp
access-list 102 permit tcp any any eq 1194
access-list 102 permit udp any any
access-list 102 permit tcp any any
access-list 102 permit icmp any [ISP_P2P_IP] 0.0.0.3 echo
access-list 102 permit icmp any [ISP_P2P_IP] 0.0.0.3 echo-reply
access-list 102 deny   ip host 195.154.109.72 any
access-list 102 deny   ip 192.168.0.0 0.0.255.255 any
access-list 102 deny   ip 172.16.0.0 0.15.255.255 any
access-list 102 deny   ip 10.0.0.0 0.255.255.255 any
access-list 102 deny   ip 127.0.0.0 0.255.255.255 any
access-list 102 deny   ip 255.0.0.0 0.255.255.255 any
access-list 102 deny   ip 224.0.0.0 31.255.255.255 any
access-list 102 deny   ip host 0.0.0.0 any
access-list 103 deny   ip host 192.168.1.9 any
access-list 103 deny   ip host 192.168.1.35 any
access-list 103 permit ip any any
access-list 103 permit tcp 192.168.1.0 0.0.0.255 any
access-list 103 permit udp host 192.168.1.26 eq domain any
access-list 103 permit tcp host 192.168.1.26 eq domain any
access-list 103 permit udp 192.168.1.0 0.0.0.255 any
no cdp run

!
!
!
!
snmp-server community secret RO 90
!
!
control-plane
 !
!

!
line con 0
line aux 0
line vty 0 4
 exec-timeout 5 0
 login local
 rotary 1
 transport input ssh
!
scheduler allocate 20000 1000
end

Show ip nat translations

Pro Inside global         Inside local          Outside local         Outside global
udp [Public_IP]:137    192.168.1.16:137      192.168.255.255:137   192.168.255.255:137
udp [Public_IP]:138    192.168.1.16:138      192.168.255.255:138   192.168.255.255:138
tcp [Public_IP]:25     192.168.1.20:25       ---                   ---
tcp [Public_IP]:53     192.168.1.20:53       ---                   ---
udp [Public_IP]:53     192.168.1.20:53       ---                   ---
tcp [Public_IP]:110    192.168.1.20:110      ---                   ---
udp [Public_IP]:1194   192.168.1.20:1194     ---                   ---
tcp [Public_IP]:38682  192.168.1.52:38682    196.0.3.118:80        196.0.3.118:80
  • Please show us your configuration. – Jordan Head Jun 17 '15 at 12:47
  • I tried posting the conf but it appears disorganised can you suggest the best way to post it while still maintaining the formatting for better readability? – chico ahmad Jun 17 '15 at 12:54
  • Paste it, highlight the config, then click the button with the curly braces { } – Jordan Head Jun 17 '15 at 12:56
  • Thx Jordan. I have added the Conf – chico ahmad Jun 17 '15 at 13:00
  • Your ACL 102 will allow the ingress traffic to any UDP/TCP port. When you perform a port scan of the ports that you've included in your static PAT list, what does show ip nat translations show? Have you verified the host 192.168.1.20 is listening/responding to the static PAT port list in your config? – one.time Jun 17 '15 at 19:16
0

@Ricky Beam. Man you so through the problem to the solution. I could not see that because I thought the host and the gateway being on the same LAN would be just fine. I was still having my mail server connected to the old ISP until I had sorted out the port forwarding issue. Thank you man and whoever has taken their time to look into my problem. I am so grateful. Solution was to have my server to point to 192.168.1.21 as its gateway. Problem solved

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.