Static port forward 1194 to VPN server behind Cisco router

Question

I'm trying to setup a VPN server behind a Cisco router which is my main internet gateway. I've set it up as shown in the attached picture. The problem I'm observing is that zero packets with a destination port of 1194 are arriving at the VPN server on the 10.10.10.2 interface. So I'm questioning whether my NAT configuration is correct on the Cisco Router. I've included the nat rules that I've defined in the picture.

If I perform an online UDP port-scan on my public IP from a remote network it indicates that port 1194/UDP is open. Any help would be appreciated.

Cisco Router Config:

Current configuration : 14472 bytes
!
! Last configuration change at 18:21:59 UTC Sun Mar 29 2020 by <name redacted>
! NVRAM config last updated at 23:15:12 UTC Tue Mar 17 2020 by <name redacted>
!
version 15.7
service timestamps debug datetime msec
service timestamps log datetime msec
service password-encryption
!
hostname Router
!
boot-start-marker
boot system flash0:c3900-universalk9-mz.SPA.157-3.M3.bin
boot-end-marker
!
!
logging buffered 51200 warnings
enable password 7 <PASSWORD REDACTED>
!
aaa new-model
!
!         
aaa authentication login default group tacacs+ local enable
aaa authentication enable default enable
aaa authorization exec default group tacacs+ local if-authenticated 
aaa authorization commands 1 default group tacacs+ local if-authenticated 
aaa authorization commands 7 default local 
aaa authorization commands 15 default group tacacs+ local if-authenticated 
aaa accounting send stop-record authentication failure
aaa accounting exec default start-stop group tacacs+
aaa accounting commands 1 default start-stop group tacacs+
aaa accounting commands 15 default start-stop group tacacs+
aaa accounting network default start-stop group tacacs+
aaa accounting connection default start-stop group tacacs+
aaa accounting system default start-stop group tacacs+
!
aaa session-id common
!
crypto pki trustpoint TP-self-signed-1899486086
 enrollment selfsigned
 subject-name cn=IOS-Self-Signed-Certificate-1899486086
 revocation-check none
 rsakeypair TP-self-signed-1899486086
!
crypto pki certificate chain TP-self-signed-1899486086
 certificate self-signed 01
  <KEY REDACTED>
    quit
!
!
no ip domain lookup
ip domain name yourdomain.com
ip multicast-routing 
ip cef
no ipv6 cef
!
multilink bundle-name authenticated
!
voice-card 0
!
vxml logging-tag
license udi pid C3900-SPE100/K9 sn FOC164450P4
hw-module sm 1
!
username <name redacted> privilege 15 secret 5 <password redacted>
!
redundancy
!
interface Loopback0
 ip address 192.168.1.192 255.255.255.255
 no ip redirects
 no ip unreachables
 no ip proxy-arp
 ip mtu 1374
 ip pim sparse-mode
 no ip route-cache
 ip ospf 1 area 0
!
interface Tunnel55
 ip address 6.78.4.230 255.255.255.252
 shutdown
 tunnel source GigabitEthernet0/1.55
 tunnel destination 6.78.4.226
!
interface Embedded-Service-Engine0/0
 no ip address
 shutdown
!
interface GigabitEthernet0/0
 description UNUSED PORT
 no ip address
 shutdown
 duplex auto
 speed auto
!
interface GigabitEthernet0/1
 description connection to 5548
 no ip address
 media-type sfp
!
interface GigabitEthernet0/1.5
 description Test VLAN for VRRP (VLAN 5)
 encapsulation dot1Q 5
 ip address 6.78.2.225 255.255.255.252
 ip pim sparse-mode
 ip ospf authentication message-digest
 ip ospf message-digest-key 1 md5 7 <KEY REDACTED>
 ip ospf 1 area 0
!
interface GigabitEthernet0/1.9
 description vlan 9 <unused>
 encapsulation dot1Q 9
 ip address 180.180.180.161 255.255.255.224
 shutdown
!
interface GigabitEthernet0/1.10
 encapsulation dot1Q 10
 ip address 192.168.1.1 255.255.255.128
 ip pim sparse-mode
 ip nat inside
 ip virtual-reassembly in
!
interface GigabitEthernet0/1.14
 description Test VLAN interface for VRRP
 encapsulation dot1Q 14
 ip address 6.78.1.225 255.255.255.252
 ip pim sparse-mode
 shutdown
!
interface GigabitEthernet0/1.55
 description Test VLAN for VRRP to CSR 1000v
 encapsulation dot1Q 55
 ip address 6.78.4.225 255.255.255.252
 ip pim sparse-mode
 ip ospf authentication message-digest
 ip ospf message-digest-key 1 md5 7 <KEY REDACTED>
 ip ospf 1 area 0
 shutdown
!         
interface GigabitEthernet0/1.200
 description Connection to PFSense VM
 encapsulation dot1Q 200
 ip address 10.10.10.1 255.255.255.252
 ip nat inside
 ip virtual-reassembly in
!
interface GigabitEthernet0/2
 description Connection to the Internet
 mac-address 0005.eb00.2ba0
 ip address aaa.bbb.ccc.158 255.255.255.252
 ip nat outside
 ip virtual-reassembly in
 duplex auto
 speed auto
!
interface GigabitEthernet0/0/0
 no ip address
 media-type sfp
!
interface GigabitEthernet0/0/0.305
 description VLAN 5 Uplink for vNIA4
 encapsulation dot1Q 305
 ip address 5.67.1.225 255.255.255.252
 ip pim sparse-mode
 ip ospf authentication message-digest
 ip ospf message-digest-key 1 md5 7 <KEY REDACTED>
 ip ospf 1 area 0.0.0.1
!
interface GigabitEthernet0/0/0.310
 description VLAN 10 for New Lab
 encapsulation dot1Q 310
 ip address 5.67.1.1 255.255.255.128
!
interface GigabitEthernet0/0/0.340
 description Overlay Transport (TEP)
 encapsulation dot1Q 340
 ip address 5.67.40.1 255.255.255.128
!
interface GigabitEthernet0/0/0.360
 description VLAN Uplink for Edge T0
 encapsulation dot1Q 360
 ip address 5.67.60.1 255.255.255.128
!
interface GigabitEthernet0/0/0.370
 description VLAN Uplink for Edge T0
 encapsulation dot1Q 370
 ip address 5.67.70.1 255.255.255.128
!
interface SM1/0
 no ip address
 shutdown
 !Application: Restarted at Wed Jul 24 21:34:04 2019
!
interface SM1/1
 description Internal switch interface connected to Service Module
 no ip address
!
interface Vlan1
 no ip address
!
router ospf 1
 router-id 6.78.1.225
 network 5.67.1.0 0.0.0.127 area 0
 network 5.67.40.0 0.0.0.127 area 0
 network 5.67.60.0 0.0.0.127 area 0
 network 5.67.70.0 0.0.0.127 area 0
 network 6.78.1.224 0.0.0.3 area 0
 network 192.168.1.0 0.0.0.127 area 0
 network 192.168.3.224 0.0.0.3 area 0
 network 192.168.12.0 0.0.0.255 area 0
!
router rip
 network 192.168.1.0
!
ip forward-protocol nd
!
no ip http server
no ip http secure-server
!
ip pim bsr-candidate Loopback0 24 197
ip pim rp-candidate Loopback0 group-list 2
ip nat inside source list 4 interface GigabitEthernet0/2 overload
ip nat inside source static udp 10.10.10.2 1194 interface GigabitEthernet0/2 1194
ip nat inside source static udp 10.10.10.2 22 interface GigabitEthernet0/2 22
ip route 0.0.0.0 0.0.0.0 aaa.bbb.ccc.157
ip route 10.0.8.0 255.255.255.248 192.168.1.15
ip ssh version 2
!
ipv6 ioam timestamp
!
nls resp-timeout 1
cpd cr-id 1
!
snmp-server group network-admin v3 priv 
!
access-list 2 permit 224.9.10.59
access-list 2 permit 224.9.10.58
access-list 2 permit 224.191.107.0 0.0.0.255
access-list 2 permit 224.194.21.0 0.0.0.255
access-list 2 permit 224.193.21.0 0.0.0.255
access-list 2 permit 224.193.25.0 0.0.0.255
access-list 2 permit 224.191.108.0 0.0.0.255
access-list 2 permit 224.191.109.0 0.0.0.255
access-list 2 permit 224.191.110.0 0.0.0.255
access-list 2 permit 224.199.0.0 0.0.255.255
access-list 2 permit 224.192.11.0 0.0.0.255
access-list 2 permit 224.193.24.0 0.0.0.255
access-list 2 permit 224.190.14.0 0.0.0.255
access-list 2 permit 224.1.2.0 0.0.0.255
access-list 2 permit 224.192.14.0 0.0.0.255
access-list 2 permit 224.192.15.0 0.0.0.255
access-list 2 permit 224.192.16.0 0.0.0.255
access-list 2 permit 224.192.17.0 0.0.0.255
access-list 2 permit 224.192.18.0 0.0.0.255
access-list 2 permit 224.192.13.0 0.0.0.255
access-list 2 permit 224.190.12.0 0.0.0.255
access-list 2 permit 239.0.55.0 0.0.0.255
access-list 3 permit 224.191.20.0 0.0.0.255
access-list 3 permit 224.192.20.0 0.0.0.255
access-list 4 permit 192.168.1.111
access-list 4 permit 10.10.10.2
access-list 4 permit 192.168.1.121
access-list 4 permit 192.168.1.120
access-list 4 permit 192.168.1.123
access-list 4 permit 192.168.1.122
access-list 4 permit 192.168.1.125
access-list 4 permit 192.168.1.124
access-list 4 permit 192.168.1.126
access-list 4 permit 192.168.1.79
access-list 4 permit 192.168.1.78
access-list 4 permit 192.168.1.64
access-list 4 permit 192.168.1.68
access-list 4 permit 192.168.1.92
access-list 4 permit 192.168.1.80
access-list 4 permit 192.168.1.57
access-list 4 permit 192.168.1.59
access-list 4 permit 192.168.1.58
access-list 4 permit 192.168.1.61
access-list 4 permit 192.168.1.60
access-list 4 permit 192.168.1.63
access-list 4 permit 192.168.1.62
access-list 4 permit 192.168.1.2
access-list 4 deny   any
!
control-plane
!
mgcp behavior rsip-range tgcp-only
mgcp behavior comedia-role none
mgcp behavior comedia-check-media-src disable
mgcp behavior comedia-sdp-force disable
!
mgcp profile default
!
gatekeeper
 shutdown
!
 vstack
alias exec c conf t
alias exec w copy system:running-config nvram:startup-config
alias exec sii sho ip int brief
!
banner exec ^C
<BANNER REDACTED>
^C
banner login ^C
<BANNER REDACTED>
^C
!
line con 0
line aux 0
line 2
 no activation-character
 no exec
 transport preferred none
 transport output lat pad telnet rlogin lapb-ta mop udptn v120 ssh
 stopbits 1
line 67
 no activation-character
 no exec
 transport preferred none
 transport input ssh
 transport output lat pad telnet rlogin lapb-ta mop udptn v120 ssh
 stopbits 1
line vty 0 4
 access-class 1 in
 privilege level 15
 transport input ssh
line vty 5 15
 access-class 1 in
 privilege level 15
 transport input ssh
!
scheduler allocate 20000 1000
ntp authentication-key 1 md5 <KEY REDACTED> 7
ntp authenticate
ntp trusted-key 1
ntp source Loopback0
ntp master 5
ntp update-calendar
!
end

Also, I've added a static nat rule to forward port 22 to the pfsense router but that's not working either.

I've updated the drawing to provide a closer approximation to the actual setup. Obviously there's a fair amount more going on based on what you can see in the above linked router config. But I do not believe any of the extra stuff is relevant to the question or the cause my issues.

Since I'm not see any traffic on port 1194 being forwarded to the pfsense router, I'd like to know if there's a way to know for certain that any traffic on that port is even arriving at the gi0/2 interface at all. It appears I can't setup a SPAN port on a Cisco Router.

Answer 1

I've come to discover that there is actually nothing wrong with the configuration that I put in place. The problem was that I did not have a clear picture of how our internet service was being provided to us. This is in a lab environment at work. The internet service is being provided to the lab by our corporate IT department. I had originally thought that we had a direct connection to the internet. This was due to the fact that the IP address on our internet facing port on the Cisco 3925 is not in the private IP address space. However, given that the IP address is statically assigned within a /30 subnet, it's clear that IT has purchased a block of static public IPs and further subnetted that block for this purpose. To prove this out I disconnected the Cisco 3925 from the internet connection and plugged in a Linux laptop (after spoofing the 3925's MAC address so-as not to trip port security). From there I used tcpdump to view the inbound traffic to the laptop.

Here is a better representation of the network: