bobbydall2000
asked on
Cisco Router Allow Incoming Ports to all IPs
Hello all.
Need help with a router config. I can setup port forwarding easily to an internal static IP. Works fine. I am adding 2 VISA machine that work over ip and DHCP internal. Visa has told me the ports to open and the static routable IP address they will be communicating from.
I need to setup an access list that will allow any traffice on these ports from a specific IP to any internal machines. Does this look correct:
access-list 100 permit tcp host <Routable IP> any eq <port number1>
access-list 100 permit tcp host <Routable IP> any eq <port number2>
access-list 100 permit tcp host <Routable IP> any eq <port number3>
access-list 100 deny tcp any any eq <port number1>
access-list 100 deny tcp any any eq <port number2>
access-list 100 deny tcp any any eq <port number3>
access-list 100 permit ip any any
interface dialer1
ip acces-group 100 in
Cheers
Mark
Need help with a router config. I can setup port forwarding easily to an internal static IP. Works fine. I am adding 2 VISA machine that work over ip and DHCP internal. Visa has told me the ports to open and the static routable IP address they will be communicating from.
I need to setup an access list that will allow any traffice on these ports from a specific IP to any internal machines. Does this look correct:
access-list 100 permit tcp host <Routable IP> any eq <port number1>
access-list 100 permit tcp host <Routable IP> any eq <port number2>
access-list 100 permit tcp host <Routable IP> any eq <port number3>
access-list 100 deny tcp any any eq <port number1>
access-list 100 deny tcp any any eq <port number2>
access-list 100 deny tcp any any eq <port number3>
access-list 100 permit ip any any
interface dialer1
ip acces-group 100 in
Cheers
Mark
ASKER CERTIFIED SOLUTION
membership
Create a free account to see this answer
Signing up is free and takes 30 seconds. No credit card required.
ASKER
VISA need to communicate not with a computer, but with it's VISA terminals. They installed terminals that will communicate through IP instead of phone line.
Cheers
Mark
Cheers
Mark
What exactly is happening with this VISA stuff, are your computers requesting traffic from a VISA machine or what? Is VISA from the outside making the requests in the first place. I guess I dont see what they are trying to do and why they need to get in from the outside to any computer on the inside unless a computer from the inside requests the traffic in the first place.
My reasoning is that if the VISA from the outside is responding to an inside request, then you need to switch the eq "port" to the source not the destination, and you'd be better off changing the access list to accept an "established" connections, for example
access-list 100 permit tcp "Static IP" eq "port any established
That would allow all established (which means a response to a SYN packet) connections back in on those ports.