Link to home
Start Free TrialLog in
Avatar of bobbydall2000
bobbydall2000

asked on

Cisco Router Allow Incoming Ports to all IPs

Hello all.

Need help with a router config.  I can setup port forwarding easily to an internal static IP.  Works fine.  I am adding 2 VISA machine that work over ip and DHCP internal.  Visa has told me the ports to open and the static routable IP address they will be communicating from.  

I need to setup an access list that will allow any traffice on these ports from a specific IP to any internal machines.  Does this look correct:

access-list 100 permit tcp host <Routable IP> any eq <port number1>
access-list 100 permit tcp host <Routable IP> any eq <port number2>
access-list 100 permit tcp host <Routable IP> any eq <port number3>
access-list 100 deny tcp any any eq <port number1>
access-list 100 deny tcp any any eq <port number2>
access-list 100 deny tcp any any eq <port number3>
access-list 100 permit ip any any

interface dialer1
 ip acces-group 100 in

Cheers
Mark
ASKER CERTIFIED SOLUTION
Avatar of mikebernhardt
mikebernhardt
Flag of United States of America image

Link to home
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
Start Free Trial
Avatar of TheTull
TheTull

Question:

What exactly is happening with this VISA stuff, are your computers requesting traffic from a VISA machine or what?  Is VISA from the outside making the requests in the first place.  I guess I dont see what they are trying to do and why they need to get in from the outside to any computer on the inside unless a computer from the inside requests the traffic in the first place.

My reasoning is that if the VISA from the outside is responding to an inside request, then you need to switch the eq "port" to the source not the destination, and you'd be better off changing the access list to accept an "established" connections, for example

access-list 100 permit tcp "Static IP" eq "port any established

That would allow all established (which means a response to a SYN packet) connections back in on those ports.  

Avatar of bobbydall2000

ASKER

VISA need to communicate not with a computer, but with it's VISA terminals.  They installed terminals that will communicate through IP instead of phone line.

Cheers
Mark