That's not entirely true. You can NAT backward into your network to an IP address that is not directly connected as long is it's not natted on the next device in line and there is a route to get to it.
Mathew, let's rule out security as a problem and remove the access lists from the VLAN interface and the Dialer interface and then try to telnet again and let's see what happens. The NAT is correct but the access lists are pretty restrictive so let's rule them out as a possible cause.
Main Topics
Browse All Topics





by: wiscomPosted on 2009-08-20 at 17:47:48ID: 25148297
Hi,
Static NAT port forwarding will only perform at directly connected networks. So in this case to the 10.0.0.x network.
The only solution to portforward from the Internet to network address 172.16.0.1 is to portforward twise:
on the router it will be:
ip nat inside source static tcp 10.0.0.10 25 interface Dialer0 25
on the firewall it will be
ip nat inside source static tcp 172.16.0.1 25 10.0.0.10 25
of course you need to configure the firewall with a default gatway address pointed to address 10.0.0.1 and on the server to 172.16.0.10
Add also this acl statement:
access-list 101 permit tcp any any eq 25
Finally, replace this acl statement:
access-list 102 permit ip any host 10.0.0.1
ino
access-list 102 permit ip any host 10.0.0.10
To do this follow these tesps:
no access-list 102
access-list 102 remark Traffic allowed to enter the router from the Ethernet
access-list 102 permit ip any host 10.0.0.10
access-list 102 deny ip any host 10.0.0.255
access-list 102 deny udp any any eq tftp log
access-list 102 deny ip any 0.0.0.0 0.255.255.255 log
access-list 102 deny ip any 127.0.0.0 0.255.255.255 log
access-list 102 deny ip any 169.254.0.0 0.0.255.255 log
access-list 102 deny ip any 192.0.2.0 0.0.0.255 log
access-list 102 deny ip any 192.168.0.0 0.0.255.255 log
access-list 102 deny ip any 198.18.0.0 0.1.255.255 log
access-list 102 deny udp any any eq 135 log
access-list 102 deny tcp any any eq 135 log
access-list 102 deny udp any any eq netbios-ns log
access-list 102 deny udp any any eq netbios-dgm log
access-list 102 deny tcp any any eq 445 log
access-list 102 permit ip 10.0.0.0 0.0.0.255 any
access-list 102 permit ip any host 255.255.255.255
access-list 102 permit ip any any log
end
NOTE: please perform all this from the CONSOLE interface of the router and the firewall !!!!!!
Good luck !
A/