I have a Cisco 1921 and I want to allow one WAN IP number (lets call it to access a server on the LAN. My WAN interface is GigabitEthernet0/0 and my LAN interface is GigabitEthernet0/1. I have now one access list that is applied both to inbound GigabitEthernet0/0 and outbound GigabitEthernet0/1 it is this one here:

10 permit udp host eq domain any
20 permit udp host NTPIP eq ntp host ciscoIP eq ntp
25 permit tcp host eq 3389 host eq 3389
26 permit udp host eq 3389 host eq 3389
28 deny udp any any eq 3389
29 deny tcp any any eq 3389
30 permit ip any any

With this access list I can not get my RDP connection to work, but if I replace that access list with one that has only one line 10 permit ip any any on the inbound interface GigabitEthernet0/0 then RDP works fine, which means I must have set up NAT port forwarding correctly right?

As far as I can tell then lines 25 and 26 should allow to access port 3389 and lines 28 and 29 should ban all other IP's. So where am I going wrong here?

1 Answer 1


If you have port forwarding set up correctly, you don't want to restrict this on the WAN port since the incoming packet will not have the private address as the destination address in the incoming packet.

Port forwarding will allow publicly addressed packets toward a particular private address. The ACL could then include only the source address and RDP port in to restrict the source device, but the port forwarding will take care of only forwarding it to the configured private IP address.

  • How would I do that? I am pretty new to access lists so please bare with me.
    – ojs
    Oct 28, 2015 at 22:24
  • Instead of host, use any. The port forwarding allows any outside host sending to the public address, port 3389 to go to the particular host, and only that host. What you want to do is restrict which outside hosts are allowed to do that. The important part is to allow the one outside host using that port to come in, and to deny other hosts. The ACL will control which host(s) can come in on that port, and port forwarding will restrict the traffic to the particular host. (As an aside, it should be, "please bear with me," unless you are inviting me to get naked with you. :))
    – Ron Maupin
    Oct 28, 2015 at 22:33
  • Ok, thanks, will try that tomorrow am home now and not on the relevant IP to test this. (As an aside, I always forget the difference between bare, bear, beer, and I have to get to know you a lot more to get bare with you :-) )
    – ojs
    Oct 28, 2015 at 22:41

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.