1

Today i was trying to configure port forwarding in one of my client's office. They wanted me to forward ports like 5000 and 6000. I was given the GUI access of the cisco router 2900 series. I could not see any options for NAT or ACL there. I doubt we can't forward ports from that particular router. Help me if there is any way we can do that via CLI.

My private ip is 172.16.32.250 and my private is 5.6.7.8. When someone does 5.6.7.8:5000 from their browser outside the office, i want them to have the interface of my biometric devices. I want TCP 5000 to be opened/forwarded.

Is it not called port forwarding? Please help me understand this concept better. Please help

1
  • 1
    There's not enough information here to explain how to do it effectively. Dec 7, 2016 at 14:47

2 Answers 2

3

You can absolutely do Network Address Translation on the 2900.

Cisco has a public document here: http://www.cisco.com/c/en/us/support/docs/long-reach-ethernet-lre-digital-subscriber-line-xdsl/asymmetric-digital-subscriber-line-adsl/12905-827spat.html

I'm not certain what you would be doing with forwarding 5000 and 6000 into the network, but I suppose that's their business. However it might be helpful if we knew what they are trying to accomplish.

I've never used the GUI to configure a IOS router. I suggest using the CLI. The command:

router #sh ip int br

will list your interfaces and help you determine that is inside vs outside.

Edit your inside interface, adding the line ip nat inside

router #conf t
router (config)#int gi0/1
router (config-if)#ip nat inside
router (config-if)#

Do the same with your outside interface but make sure you tell the router this is the outside NAT interface.

router (config-if)#int gi0/0
router (config-if)#ip nat outside
router (config-if)#end
router (config)#

Tell the router what you want to NAT with an access list

router (config)#ip nat inside source list 101 interface gi0/0 overload

Build the access list. An extended access list is required if you want to specify the port.

router (config)#ip access-list extended 101 
router (config-ext-nacl)#permit tcp any eq 6000 host 1.2.3.4 eq 6000  

EDIT

I'll use 1.2.3.4 as the public IP the server on the internet side of the router. Make sure you identify what the IP reaching out to the biometric device is... I put "any" in the above example, but it's just an example. I prefer not to use "any" if at all possible.

If TCP:

router #permit tcp host 172.16.32.250 eq 5000 host 1.2.3.4 eq 5000
router #permit tcp host 172.16.32.250 eq 6000 host 1.2.3.4 eq 6000

If UDP:

router #permit udp host 172.16.32.250 eq 5000 host 1.2.3.4 eq 5000
router #permit udp host 172.16.32.250 eq 6000 host 1.2.3.4 eq 6000

END OF EDIT

After the Permit, you can specify the protocol (TCP, UDP, ICMP, ESP, etc) or everything with IP. You can use host and an IP or IP address + subnet mask.

router (config-if)#end
router #copy run start
9
  • Thank you for the help. Actually, we needed ports to opened for bio-metric devices.
    – de.walkar
    Dec 11, 2016 at 14:34
  • I am thankful to you for the commands but this has not worked in my case. I need to open port 5000 in ip 172.16.32.250 and followed your commands, yet the forwarding has not happen
    – de.walkar
    Dec 12, 2016 at 9:09
  • Need additional information. Are you saying you need to open port 5000 from your outside interface to 172.16.32.250? Are you translating the port from/to something other than original? Dec 12, 2016 at 15:00
  • Also, UDP or TCP? Dec 12, 2016 at 15:36
  • There was this command in the show run config "ip http timeout-policy idle 60 life 86400 requests 10000" .Does this have anything to do with my NAT not working?
    – de.walkar
    Dec 13, 2016 at 5:05
0

Your Configuration clearly shows natting .

In router portforwarding can be managed by Access-list

Portforwarding is allowing access to resources on another networks behind firewall

Firewall act as a border between two networks portforwarding ensures accessing resources on other networks

Configure policy in security device

Source ip address

Destination ip address

Service ports

Action :Allow

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.