3

I have a Cisco 1921 and I want to allow one WAN IP number (lets call it 1.2.3.4) to access a server on the LAN. My WAN interface is GigabitEthernet0/0 and my LAN interface is GigabitEthernet0/1. I have now one access list that is applied both to inbound GigabitEthernet0/0 and outbound GigabitEthernet0/1 it is this one here:

10 permit udp host 8.8.8.8 eq domain any
20 permit udp host NTPIP eq ntp host ciscoIP eq ntp
25 permit tcp host 1.2.3.4 eq 3389 host 192.168.31.9 eq 3389
26 permit udp host 1.2.3.4 eq 3389 host 192.168.31.9 eq 3389
28 deny udp any any eq 3389
29 deny tcp any any eq 3389
30 permit ip any any

With this access list I can not get my RDP connection to work, but if I replace that access list with one that has only one line 10 permit ip any any on the inbound interface GigabitEthernet0/0 then RDP works fine, which means I must have set up NAT port forwarding correctly right?

As far as I can tell then lines 25 and 26 should allow 1.2.3.4 to access port 3389 and lines 28 and 29 should ban all other IP's. So where am I going wrong here?

2

If you have port forwarding set up correctly, you don't want to restrict this on the WAN port since the incoming packet will not have the private address as the destination address in the incoming packet.

Port forwarding will allow publicly addressed packets toward a particular private address. The ACL could then include only the source address and RDP port in to restrict the source device, but the port forwarding will take care of only forwarding it to the configured private IP address.

  • How would I do that? I am pretty new to access lists so please bare with me. – ojs Oct 28 '15 at 22:24
  • Instead of host 192.168.31.9, use any. The port forwarding allows any outside host sending to the public address, port 3389 to go to the particular host, and only that host. What you want to do is restrict which outside hosts are allowed to do that. The important part is to allow the one outside host using that port to come in, and to deny other hosts. The ACL will control which host(s) can come in on that port, and port forwarding will restrict the traffic to the particular host. (As an aside, it should be, "please bear with me," unless you are inviting me to get naked with you. :)) – Ron Maupin Oct 28 '15 at 22:33
  • Ok, thanks, will try that tomorrow am home now and not on the relevant IP to test this. (As an aside, I always forget the difference between bare, bear, beer, and I have to get to know you a lot more to get bare with you :-) ) – ojs Oct 28 '15 at 22:41

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.