Solved

Cisco 2600 Port Forwarding

Posted on 2004-10-24
2,491 Views
Last Modified: 2009-02-27
Hello,
I need to configure my Cisco 2600 router to allow outside (Internet) access to three devices inside my network.  The devices are connected to a PC dedicated to the instruments to be monitored.  I think I need to allow port forwarding, but I don't know much about Cisco router management.  I only have one (real) static IP for my router, but I can assign an internal IP to all the devices, the PC, or whatever we need to do.  I have no idea how to assign a port access while protecting the rest of my network and router.  Can someone help by giving me a sample and also exactly where to insert it into the config script?
Whit
0
Question by:DMTCALASKA
    15 Comments
     
    LVL 5

    Accepted Solution

    by:
    You can just do "config t" and start typing commands. For example, if you wanted to forward TCP port 3389 (remote desktop) to a machine, you would do the following:

    ip nat inside source static tcp <inside ip> 3389 interface <your outside interface> 3389

    Use as many of those commands as you need.

    -Eric
    0
     

    Author Comment

    by:DMTCALASKA
    We are getting there Eric.  When I type "config t" then enter followed by the script then ctrl z, I did sh config and it isn't showing up.  What am I doing wrong?
    Whit
    0
     
    LVL 5

    Expert Comment

    by:epylko
    Try "sh run" or do a "copy run start" or "wr mem" before "sh config"

    -Eric
    0
     

    Author Comment

    by:DMTCALASKA
    THat did it.  Thanks Eric,
    Whir
    0
     

    Author Comment

    by:DMTCALASKA
    Still a problem.  So what I want to do is access a laptop inside my LAN from the Internet.  I have configured the router as follows:
    <ip nat inside source static tcp 192.168.1.xxx 1000 209.xxx.xxx.xx 1000>
    If this is correct (less the xxx's of course) how do I get to the laptop which has the same IP and port setting from Win Explorer?
    I can ping it from inside.
    Whit
    0
     
    LVL 5

    Expert Comment

    by:epylko
    Are you sure you only need port 1000? Do you really need a 1:1 NAT and have all ports open? You might need to do:

    ip nat inside source static <inside IP> interface <outside interface>

    Also, unless you have a static IP address on your router, make sure you use the interface command for the outside address, not an address you get through DHCP.

    -Eric
    0
     

    Author Comment

    by:DMTCALASKA
    Eric,
    My router does have a static IP that I assigned and a real IP assigned by the ISP.  I have been using the ISP assigned IP for the outside interface.  I think the problem is that I left the term <interface> out of the line.  How do I get back into the line to correct it?
    Whit
    0
     
    LVL 5

    Expert Comment

    by:epylko
    The same way... "config t" and then you have to remove the line with "no ip nat inside..." and then put the entry back in.

    -Eric
    0
     

    Author Comment

    by:DMTCALASKA
    Eric,
    Once I have the Router (Config)# prompt, how do I get to the script to remove it?
    Whit
    0
     
    LVL 5

    Expert Comment

    by:epylko
    You type the same command but with the word "no" in front of it.
    0
     

    Author Comment

    by:DMTCALASKA
    Eirc,
    I am beginning to feel really stupid.
    Here is what I type in and keep getting an error:
    <ip nat inside source static tcp 192.168.0.xxx 1000 interface 209.112.xxx.xx 1000>
    I get an error ^ at the 2 in 209.112......
    What am I doing wrong?
    Whit
    0
     
    LVL 5

    Expert Comment

    by:epylko
    You can always use a "?" where there is an error. IOS will tell you the command syntax.

    If you use the interface keyword you have to specify an interface after it, not an IP address.

    Do you have any access-lists on your router which might be blocking traffic?

    -Eric
    0
     

    Author Comment

    by:DMTCALASKA
    Yes, I think I have everything denied.  How should I set the access?  Also, what should the outside interface look like?  If there is a way to copy the script, I will paste it on a message for you to review.  How do I do that?
    Whit
    0
     

    Author Comment

    by:DMTCALASKA
    I am looking for an answer to three things
    1. What script do I need to added to allow the port access from outside?  I think I must have it denied.
    2. What is the format of the <outside interface>
    3. How do I print or copy my config file so I can have you tae a look?
    Thanks,
    Whit
    0
     
    LVL 2

    Expert Comment

    by:Stevexpress
    this is what you had
    <ip nat inside source static tcp 192.168.0.xxx 1000 interface 209.112.xxx.xx 1000>

    This is what you needed (assuming E0/0 is the correct interface)

    ip nat inside source static tcp 192.168.0.20 1000 interface Ethernet0/0 1000
    0

    Write Comment

    Please enter a first name

    Please enter a last name

    We will never share this with anyone.

    Featured Post

    Looking for New Ways to Advertise?

    Engage with tech pros in our community with native advertising, as a Vendor Expert, and more.

    Problem Description:   Couple of months ago we upgraded the ADSL line at our branch office from Home to Business line. The purpose of transforming the service to have static public IP’s. We were in need for public IP’s to publish our web resour…
    Creating an OSPF network that automatically (dynamically) reroutes network traffic over other connections to prevent network downtime.
    After creating this article (http://www.experts-exchange.com/articles/23699/Setup-Mikrotik-routers-with-OSPF.html), I decided to make a video (no audio) to show you how to configure the routers and run some trace routes and pings between the 7 sites…
    After creating this article (http://www.experts-exchange.com/articles/23699/Setup-Mikrotik-routers-with-OSPF.html), I decided to make a video (no audio) to show you how to configure the routers and run some trace routes and pings between the 7 sites…

    913 members asked questions and received personalized solutions in the past 7 days.

    Join the community of 500,000 technology professionals and ask your questions.

    Join & Ask a Question

    Need Help in Real-Time?

    Connect with top rated Experts

    17 Experts available now in Live!

    Get 1:1 Help Now