Want to protect your cyber security and still get fast solutions? Ask a secure question today.Go Premium

x
?
Solved

Cisco Router Allow Incoming Ports to all IPs

Posted on 2006-03-23
3
Medium Priority
?
350 Views
Last Modified: 2006-11-18
Hello all.

Need help with a router config.  I can setup port forwarding easily to an internal static IP.  Works fine.  I am adding 2 VISA machine that work over ip and DHCP internal.  Visa has told me the ports to open and the static routable IP address they will be communicating from.  

I need to setup an access list that will allow any traffice on these ports from a specific IP to any internal machines.  Does this look correct:

access-list 100 permit tcp host <Routable IP> any eq <port number1>
access-list 100 permit tcp host <Routable IP> any eq <port number2>
access-list 100 permit tcp host <Routable IP> any eq <port number3>
access-list 100 deny tcp any any eq <port number1>
access-list 100 deny tcp any any eq <port number2>
access-list 100 deny tcp any any eq <port number3>
access-list 100 permit ip any any

interface dialer1
 ip acces-group 100 in

Cheers
Mark
0
Comment
Question by:bobbydall2000
3 Comments
 
LVL 28

Accepted Solution

by:
mikebernhardt earned 2000 total points
ID: 16275311
That will work as expected, except that as long as you're creating an access list, how about limiting some of the other things that you don't want people doing from the outside? You're actually better off figuring out what you DO need and then by default not allowing anything else.

The only thing your list denies is attempted access to that specific port on any machine. What about Windows, telnet, and everything else that people try to do into your network?

If it's a dedicated link from VISA, why permit everything at the end?

things to think about...
0
 
LVL 7

Expert Comment

by:TheTull
ID: 16277185
Question:

What exactly is happening with this VISA stuff, are your computers requesting traffic from a VISA machine or what?  Is VISA from the outside making the requests in the first place.  I guess I dont see what they are trying to do and why they need to get in from the outside to any computer on the inside unless a computer from the inside requests the traffic in the first place.

My reasoning is that if the VISA from the outside is responding to an inside request, then you need to switch the eq "port" to the source not the destination, and you'd be better off changing the access list to accept an "established" connections, for example

access-list 100 permit tcp "Static IP" eq "port any established

That would allow all established (which means a response to a SYN packet) connections back in on those ports.  

0
 
LVL 2

Author Comment

by:bobbydall2000
ID: 16294163
VISA need to communicate not with a computer, but with it's VISA terminals.  They installed terminals that will communicate through IP instead of phone line.

Cheers
Mark
0

Featured Post

Concerto's Cloud Advisory Services

Want to avoid the missteps to gaining all the benefits of the cloud? Learn more about the different assessment options from our Cloud Advisory team.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

New Server 172.16.200.2  was moved from behind Router R2 f0/1 to behind router R1 int f/01 and has now address 172.16.100.2. But we want users still to be able to connected to it by old IP. How to do it ? We can used destination NAT (DNAT).  In DNAT…
It happens many times that access list (ACL) have to be applied to outgoing router interface in order to limit some traffic.This article is about how to test ACL from the router which is not very intuitive for everyone. Below scenario shows simple s…
After creating this article (http://www.experts-exchange.com/articles/23699/Setup-Mikrotik-routers-with-OSPF.html), I decided to make a video (no audio) to show you how to configure the routers and run some trace routes and pings between the 7 sites…
After creating this article (http://www.experts-exchange.com/articles/23699/Setup-Mikrotik-routers-with-OSPF.html), I decided to make a video (no audio) to show you how to configure the routers and run some trace routes and pings between the 7 sites…

578 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question