Cisco Blocks ALL Inbound Ports on Outside NAT Interface


     I have a T1 line that goes straight into a Cisco router, today it just started blocking all ports out of the blue, I've been trying to figure it out but i can't, i've even removed every resemblance of security on the router and made sure that there is nothing other than a permit any ACL assigned to the NAT.  its completely wide open, yet i can't get into anything.  I called the ISP and they said they never block ports, that its just an open pipe into our building.  So its gotta be an issue on the cisco.  I've attached a copy of the running config.  Let me know if there is any more info I can give, i'm afraid i'm running on empty as its 1:00 am and i've been up since 6:00 am yesterday lol, so i may have left something out.

Who is Participating?

[Product update] Infrastructure Analysis Tool is now available with Business Accounts.Learn More

I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

Ernie BeekExpertCommented:
Hi ctagle,

I took the liberty of sanitizing your config so the publics don't show completely.
I also see 3 default routes, perhaps that's the issue? Otherwise is the log showing you anything?
ctagleAuthor Commented:
i managed to figure out why ALL the ports were being blocked, i needed to set the nat up to redirect requests recieved on certain ports to the correct ip, it became obvious after some whataburger and coffee lol.  Now my problem is that i can't get certain ones to open, for example, port 25 refuses to open, i've tried everything, it was open less than a day ago, now i can't get it to open at all, whats odd is that some ports are not assigned to any well known services i don't think, like port 3394, it won't open either.  Help is greatly appreciated.

Oh and thanks for the edit, again, i've been up for way to long XD
Ernie BeekExpertCommented:
No problem :-)

So what does your config look like now?
Is it giving you any errors when configuring the ports or do they just don't work? Oh and try looking at the logs, it might tell you something.
Prepare for an Exciting Career in Cybersecurity

Help prevent cyber-threats and provide solutions to safeguard our global digital economy. Earn your MS in Cybersecurity. WGU’s MSCSIA degree program curriculum features two internationally recognized certifications from the EC-Council at no additional time or cost.

ctagleAuthor Commented:
here is a copy of the running config thats on it right now, i don't know what some of those nat entries are for but i know none of them should limit traffic.
ctagleAuthor Commented:
i perused the logs for the nat translation and there are some hosts with ports other than port 25 trying to connect, but to be honest i'm to familiar with the NAT readour
Ernie BeekExpertCommented:
Just did some testing but I am able to get through (?)
So nat seems to be working. But on port 25 (for example) I get an error which looks to be coming from the server, not the router:
421 Cannot connect to SMTP server (, connect time out

Perhaps you might want to have a look at the server(s) as well.

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
ctagleAuthor Commented:
well, at least that narrows it down, what tool did you use to get that error message btw
Ernie BeekExpertCommented:
Dosbox on windows then the command
Telnet x.x.x.74 25
So adding the port you wish to connect to behind the IP you connect to.
ctagleAuthor Commented:
huh, windows never outputs that for me, it just says connection failed, i'll see what happens, time for the wonderfully fun task troubleshooting groupwise....
Ernie BeekExpertCommented:
Ah, I remember groupwise...... Good luck ;)
ctagleAuthor Commented:
got it, thank you for help, if you hadn't have pointed me towards the server i would have still been fumbling with the router, i really do appreciate it. :D
Ernie BeekExpertCommented:
Glad I was able to help you out, now get some sleep :-)
And thx for the points.
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today

From novice to tech pro — start learning today.