6

Calling a switch mac address table a Forwarding Information Base is incorrect. The correct term, according to the original 8021.D document is Filtering Database, although this term is not commonly used. This database is more often referred as a Mac Address Table -not to be confused with the ARP table- this is the term you will find in many switch interface ...


6

There's one word missing: You need port forwarding to enable traffic initiated from the outside network/Internet. When you make a request to an external server, a NAT entry is created in the router NAT table. When the response comes backs, it matches the existing entry and is forwarded to the initiator.


6

access-list outside_acl extended permit tcp interface outside object webserver eq https access-list outside_acl extended permit tcp interface outside object webserver eq www access-list outside_acl extended permit tcp host 172.16.0.2 host 0.0.0.0 eq www access-list outside_acl extended permit tcp host 172.16.0.2 host 0.0.0.0 eq https You need to remove ...


5

A firewall does not "block all ports" - otherwise you could just pull a cable instead of having some firewall. Instead simple firewalls block all incoming connections (what you read as all ports blocked) but allow all outgoing connections - and in the case of web surfing the connections are initiated from inside and are thus outgoing. Most firewalls today ...


5

Port forwarding describes a layer-4 mechanism, operating on TCP connections or UDP packets without necessarily understanding the application data. Reverse proxy suggests a higher-layer (this is where the OSI model doesn't map directly to TCP/IP) application-aware proxy. In the old days, a proxy server was most commonly used between users and the Internet; ...


4

object service SSL service tcp source eq https destination eq https nat (inside,outside) source static Dell-Optiplex interface service any SSL Is this your Static PAT rule? If so, it is misconfigured. You are telling the ASA that any traffic going from inside to outside, with a source of Dell-Optiplex and a port of any should be translated to the ...


4

You need an additional NAT (Port-Forwarding) rule for it: If you want to do this on your outside interface GigabitEthernet1 ip nat inside source static tcp 172.29.1.130 25565 interface GigabitEthernet1 25565 If you want to do this on public internet-facing IP (belong to your assigned public IP block) - 5.6.7.8: ip nat inside source static tcp 172.29.1....


3

Basically, port forwarding is creating a manual, static entry in the NAPT table. The table will build dynamic entries as traffic is sent from inside to outside (these entries will eventually close or time out) so that traffic can return to the original sender. If the original sender is on the outside, the table will not have an entry for that. To allow ...


3

I am trying to access one of my PCs ... This seems to be the wrong web site for this kind of questions, because it is only about company networks, not about home networks. Maybe Super User is more suitable for your question. My first question would be why do I have to activate port forwarding if the IP I use to connect must be the PC IPV6? I don't know ...


3

Port forwarding is required when a NAT router 'hides' a service with a private IP address from public Internet. You'll need port forwarding on the NAT router (TP-L), the one with the WAN interface. Provided the routing works and the protocols have no NAT issues, just forward to 192.168.1.100 directly and it'll work. Cascading the port forwarding through ...


3

What tunneling does is wrap a packet inside another packet. This could be used for something like allowing a protocol such as multicast to cross the public Internet, which doesn't support multicast, to another network which does support multicast. Simply wrap the multicast packet inside a unicast packet on one end, then strip off the unicast packet on the ...


3

Also called virtual IP by some vendors, they're all the same thing.


2

The access list is evaluated in order, and it is exited on the first match. In your particular example, if the address being evaluated is in the 10.10.0.0/16 range, it will match the first entry, and the ACL evaluation will stop, so that the following ACL entries are not considered.


2

Multiple public IPs: each server requires a different public IP that clients are forwarded from Single public IP, easy and ugly setup: run servers on different ports on the public IP address and forward accordingly Single public IP, more sophisticated setup: install reverse proxy that you forward clients to, separate servers on the application layer and ...


2

All communication happens using SSH with port forwardings in both directions A well-known search engine suggests it's a quote from RIPE describing the network design for Atlas, its internet monitoring network, which has lots of probes out in the network. It has this diagram (copied per RIPE public-non-profit permissions) From reading that document, my ...


2

If Gig8 gets it's IP address dynamically (DHCP, PPPoE), you'll have to do this (in short: replace 1.2.3.4 with the interface name). ip nat inside source static tcp 192.168.170.108 8080 gigabitEthernet8 8080 ip nat inside source static tcp 192.168.170.100 9000 gigabitEthernet8 9000 Having 1.2.3.4 at this place in the NAT statement would only work if ... ...


2

R2's configuration doesn't need to change, but client 2 needs to know the address of client 1, or it needs to resolve the DNS name for it. It would be the same problem if there were no routers between client 1 and client 2.


2

You shouldn't assign "source port" because when you trying connecting from PC1 to PC2 using ssh only destination port is 22. Source port that PC1 using is dynamically assigned and it could be anything.


2

The configuration you posted is for the 8.3 or newer versions of ASA. Since you are using a version of 8.2(1) you can try something like this: static (inside,outside) tcp interface 1000 1.1.1.1 1000 netmask 255.255.255.255 access-list OUTSIDE-IN permit tcp any interface outside eq 1000 A simple search will provide you many articles on how to translate ...


2

There are (at least) two main reasons: The assumption is that you control the "inside" network. So, presumably, you're not doing the spoofing. Not every device needs to be NATted. You might have some devices that use addresses that don't need translation.


2

While both methods might look similar, they are entirely different technically. A proxy accepts a socket connection and fulfills the client request in some way or other. Usually, it creates its own request to the indicated server. The by far most common example is an HTTP proxy that accepts HTTP requests from clients, uses its own HTTP request to retrieve ...


2

VPN Routing Yes, you have some options. You can route the IP space used for your machines (let's call those the SOHO LAN subnet) from the jump box across the VPN. If you do this with multiple sites, it becomes a hub-and-spokes VPN, where the sites can access each-other. If configuring this, keep in mind, each site needs to know about the IPs it should be ...


2

interface:500 can only be bound once. Either the router's tunnel process has that IP and port, or the NAT engine does. One can limit when NAT applies, but there's no such ability for an application binding a port. (There are some VRF tricks that can move the tunnel off the outside interface, but this gets very messy.)


2

If you want two hosts behind different NAT's to talk to each other, there must be some internet reachable server to broker the connection. [see also: nat punching] If one side starts blindly transmitting, the other side will never see it, because there's no connection in the other NAT. TCP requires a handshake to setup the connection. Any NAT engine will ...


1

Routing to WAN with source NAT and immediately routing back with destination NAT is called NAT hairpinning. Some NAT routers don't support NAT hairpinning at all, some can be configured to do it but suck at performance, and some do OK. Generally, routing packets through a NAT construct that is completely unnecessary is a bad idea. Also, forcing traffic ...


1

So lets assume you have a private network, which is connected via a NAT box to the public internet. On the nat box explicit rules (sometimes referred to as "port forwards") are configured to allow servers on the private network to be reached from the public network. In this case whether or not the connection is successful comes down to the behavior of the ...


1

To add to @Zac67 and give you the "picture" you want... You are fundamentally trying to create a mini-clone of The Internet in your shop. How is it not a problem if every Linksys router LAN is set to 192.168.1.0/24? It's because those LANs aren't directly connected; NAT translates those identical LAN addresses to globally unique WAN address(es). You need ...


1

You have hit upon a big problem with NAPT. The NAPT device must maintain a state for connections. It has a table to match incoming packets with outgoing packets. IP was designed to be a stateless, end-to-end connection. Only the endpoints are supposed to maintain the state. NAPT breaks that paradigm. The connections now depend on an intermediate device to ...


Only top voted, non community-wiki answers of a minimum length are eligible