topic Re: I Can't Port forwarding with Cisco 1921 to internal web server in Network Security

I Can't Port forwarding with Cisco 1921 to internal web server

jiggaracci — Fri, 21 Feb 2020 16:40:41 GMT

I have a cisco 1921 router that I can not get to port forward/allow access to my internal webserver. SSH is open so it appears that the ISP or modem isn't blocking it (I could be wrong). Inside LAN works getting out to the internet.

Gateway of last resort is 68.119.44.1 to network 0.0.0.0

S*    0.0.0.0/0 [254/0] via 68.119.44.1
      10.0.0.0/8 is variably subnetted, 2 subnets, 2 masks
C        10.0.0.0/24 is directly connected, GigabitEthernet0/0
L        10.0.0.1/32 is directly connected, GigabitEthernet0/0
      68.0.0.0/8 is variably subnetted, 3 subnets, 2 masks
S        68.114.38.242/32 [254/0] via 68.119.44.1, GigabitEthernet0/1
C        68.119.44.0/22 is directly connected, GigabitEthernet0/1
L        68.119.44.240/32 is directly connected, GigabitEthernet0/1
R     192.168.1.0/24 [120/1] via 10.0.0.2, 00:00:01, GigabitEthernet0/0
crib#
crib#show run
Building configuration...

Current configuration : 1347 bytes
!
! Last configuration change at 01:39:03 UTC Fri Jan 18 2019 by jigga
!
version 15.0
service timestamps debug datetime msec
service timestamps log datetime msec
no service password-encryption
!
hostname crib
!
boot-start-marker
boot-end-marker
!
enable secret 5 xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
!
aaa new-model
!
!
!
!
!
!
!
aaa session-id common
!
no ipv6 cef
ip source-route
ip cef
!
!
!
!
no ip domain lookup
ip domain name xxxxxxxxxx
multilink bundle-name authenticated
!
crypto pki token default removal timeout 0
!
!
license udi pid CISCO1921/K9 sn xxxxxxxx
!
!
username grover privilege 15 secret 5 xxxxxxxxxxxx
!
!
!
!
!
!
interface GigabitEthernet0/0
 ip address 10.0.0.1 255.255.255.0
 ip nat inside
 ip virtual-reassembly
 duplex auto
 speed auto
!
interface GigabitEthernet0/1
 ip address dhcp
 ip nat outside
 ip virtual-reassembly
 duplex auto
 speed auto
!
interface Serial0/0/0
 no ip address
 shutdown
 no clock rate 2000000
!
router rip
 version 2
 network 10.0.0.0
 network 68.0.0.0
 no auto-summary
!
ip forward-protocol nd
!
no ip http server
no ip http secure-server
!
ip nat inside source list 1 interface GigabitEthernet0/1 overload
ip nat inside source static tcp 192.168.1.21 80 interface GigabitEthernet0/1 80

!
access-list 1 permit 10.0.0.0 0.255.255.255
!
!
!
control-plane
!
!
line con 0
line aux 0
line vty 0 4
 transport input ssh
!
scheduler allocate 20000 1000
end

Re: I Can't Port forwarding with Cisco 1921 to internal web server

ga88errus — Fri, 18 Jan 2019 11:35:45 GMT

please show: sh ip nat trans

with section about

192.168.1.21 80

Re: I Can't Port forwarding with Cisco 1921 to internal web server

jiggaracci — Fri, 18 Jan 2019 16:14:44 GMT

tcp 68.119.44.240:64981 10.0.0.2:64981 23.46.200.165:443 23.46.200.165:443
tcp 68.119.44.240:80 192.168.1.21:80 --- ---
crib#

Re: I Can't Port forwarding with Cisco 1921 to internal web server

ga88errus — Mon, 21 Jan 2019 07:08:52 GMT

try this:

ip nat inside source static tcp 192.168.1.21 80 interface GigabitEthernet0/1 80 extendable

Re: I Can't Port forwarding with Cisco 1921 to internal web server

jiggaracci — Mon, 21 Jan 2019 16:11:28 GMT

still port 80 not opened

crib#show ip nat translations
Pro Inside global      Inside local       Outside local      Outside global
udp 68.119.44.240:49399 10.0.0.2:49399    62.248.193.132:51348 62.248.193.132:51348
udp 68.119.44.240:49399 10.0.0.2:49399    176.228.38.95:63342 176.228.38.95:63342
tcp 68.119.44.240:56106 10.0.0.2:56106    40.122.32.148:443 40.122.32.148:443
udp 68.119.44.240:59855 10.0.0.2:59855    74.125.21.190:443 74.125.21.190:443
tcp 68.119.44.240:60353 10.0.0.2:60353    34.212.58.105:443 34.212.58.105:443
tcp 68.119.44.240:80   192.168.1.21:80    ---                ---
crib#

Re: I Can't Port forwarding with Cisco 1921 to internal web server

Jon Marshall — Mon, 21 Jan 2019 19:23:18 GMT

Can you ping the web server from the router ?

If not check default gateway of web server.

Jon

Re: I Can't Port forwarding with Cisco 1921 to internal web server

jiggaracci — Mon, 21 Jan 2019 21:51:26 GMT

Nope

Re: I Can't Port forwarding with Cisco 1921 to internal web server

jiggaracci — Tue, 22 Jan 2019 00:32:20 GMT

It looks like my Netgear N150 logs that someone from 52.202.215.126 was able to get LAN access from Remote 52.202.215.126. Looks like they're using AWS probably a hacker. It's a shame others can get access but I can't, lol

Re: I Can't Port forwarding with Cisco 1921 to internal web server

ga88errus — Tue, 22 Jan 2019 07:16:51 GMT

show route from 192.168.1.21

Re: I Can't Port forwarding with Cisco 1921 to internal web server

Jon Marshall — Tue, 22 Jan 2019 08:12:27 GMT

If you cannot ping the server then it is not going to work.

You have a route to the 192.168.1.0/24 network on your firewall so check your server and see where it's default gateway points to.

Jon

Re: I Can't Port forwarding with Cisco 1921 to internal web server

jiggaracci — Fri, 25 Jan 2019 02:35:58 GMT

Looks like the issue is with Charter...

Re: I Can't Port forwarding with Cisco 1921 to internal web server

jiggaracci — Fri, 25 Jan 2019 03:23:15 GMT

This whole thing is weird. How my setup is, I have Charter Spectrum a cable modem, connected to e1 on cisco router, e0 goes to netgear router, on this router, I can't enter any (0.0.0.0 0.0.0.0 route).

When I put the Netgear N150 that was originally behind the cisco router, connect it directly to the modem and I get an entirely different ip address. From 68.x.x.x, to 100.x.x.x. If I connect my laptop directly, I get an entire new address scheme. If I do have the netgear wifi router plugged directly to the modem, then the port forwarding works, but not with the cisco router.

Re: I Can't Port forwarding with Cisco 1921 to internal web server

Jon Marshall — Fri, 25 Jan 2019 08:13:01 GMT

As I have said already if you cannot ping the server from your router then it will not work.

Either get the routing between the routers working or remove one of the routers.

Jon

Re: I Can't Port forwarding with Cisco 1921 to internal web server

jiggaracci — Fri, 25 Jan 2019 14:09:20 GMT

I connected the modem to the router via switch, eliminating other netgear router. I verified i could ping all 3 devices in the switch. Router, server, laptop. All can communicate. I start my server, open the website canyouseeme.com. scan port 80, it's open. I stop the server, scan again, port 80 is closed.

Re: I Can't Port forwarding with Cisco 1921 to internal web server

Jon Marshall — Fri, 25 Jan 2019 14:16:41 GMT

So either you need to sort the routing out or just use the Cisco router instead.

Jon

Re: I Can't Port forwarding with Cisco 1921 to internal web server

jiggaracci — Fri, 25 Jan 2019 15:18:58 GMT

Well I'm not sure it's routing. The modem gives very different ips.
Someone else had stated the spectrum blocks ports on their end.

With the last config i used my apache server. Can access it by lan.

If i start the web server, the port scanner shows its open from the web.
When I stop the server, the port scanner from the web shows it as closed.

Therefore...

Re: I Can't Port forwarding with Cisco 1921 to internal web server

Jon Marshall — Fri, 25 Jan 2019 18:23:51 GMT

Perhaps I am not following but when you only use one router it works and when you use both routers it doesn't.

In addition when you had both routers you could not ping the web server from the Cisco router and if you can't ping it then NAT etc. is largely irrelevant.

Jon

Re: I Can't Port forwarding with Cisco 1921 to internal web server

jiggaracci — Fri, 25 Jan 2019 19:08:57 GMT

No, when I only use the cisco, running my web server ad If I goto the
external IP, i get page cant be displayed. I checked the ports with
canyouseeme.com port scanner and it says port 80 open. If I stop the
webserver, I get port 80 blocked.

When i plug in the modem to netgear wireless router, i get a different IP
address, but EVERYTHING works fine.

Dont want to use netgear, prefer cisco.