topic There is probably a gateway in Network Security

Pix 501 port forwarding

Dassca1818 — Tue, 12 Mar 2019 06:43:15 GMT

Hi everyone

first of all I have to say I don't know pratically nothing of Cisco firewalls but I'm in the need to temporarily configure an

old Pix 501, port forwarding the tcp 32976 (I need to test Neorouter software).
This Pix has already set a port forwarding for tcp 3389 to use remote desktop so I have to be careful not to stop this

service.

I paste a few lines to make understand how the pix is currently configured:

access-list (fromout) permit icmp any any
access-list (fromout) permit tcp any any eq 3389
access-list (inout) permit icmp any any
access-list (inout) permit ip 192.168.0.0 255.255.255.0 any
access-list 102 permit ip 192.168.0.0 255.255.255.0 192.168.101.0 255.255.255.0

static (inside,outside) tcp 10.77.2.76 3389 192.168.0.1 3389 netmask 255.255.255.255 0 0

access-group (fromout) in interface outside
access-group (inout) in interface inside

to open port 32976 I've addedd the following lines:

static (inside,outside) tcp 10.77.2.76 32976 192.168.0.1 32976 netmask 255.255.255.255 0 0
access-list (fromout) permit tcp any any eq 32976

I didn't add an access-group line because the (fromout) group is already active and I did not give the command "write mem"

because i believe that I can test the pix anyway and then, after restarting the Pix, this returns to the normal function

before the changes.

to test if the port is correctly opened i go here: http://www.neorouter.com/checkport.php? and I see that the port 32976

doesn't pass the test but even the port 3389, that was passing the test before, doesn't pass this test too.

Could you tell me where I'm wrong and how to open correctly the 32976 port?

Thanks to all

Dario

Seems to be necessary to open

o.melendres — Wed, 21 Oct 2015 16:33:25 GMT

Seems to be necessary to open port on ACL also:

access-list (fromout) permit tcp any any eq 32976

thank you for the answer but

Dassca1818 — Thu, 22 Oct 2015 08:09:12 GMT

thank you for the answer but I already configured pix with the following lines without any profit.

Am I missing something?

static (inside,outside) tcp 10.77.2.76 32976 192.168.0.1 32976 netmask 255.255.255.255 0 0
access-list (fromout) permit tcp any any eq 32976

If possible, could you please

o.melendres — Thu, 22 Oct 2015 08:18:33 GMT

If possible, could you please attach all related configs, ip addresses routes acls static.

The outside address 10.77.2.76 is a private address, you may have a Internet gateway that is configured with NAT port forwarding. HAve you checked the NAT rules here also?

In attachment there is the

Dassca1818 — Thu, 22 Oct 2015 08:35:10 GMT

In attachment there is the complete configuration of pix that is now runnig with port 3389 opened for remote desktop so i guess the nat rules are right.

Looks ok for 3389 port. A

o.melendres — Thu, 22 Oct 2015 10:28:38 GMT

Looks ok for 3389 port. A variation could be:

static (inside,outside) tcp interface 3389 192.168.0.1 3389 netmask 255.255.255.255 0 0

port 3389 is correctly open,

Dassca1818 — Thu, 22 Oct 2015 13:06:14 GMT

port 3389 is correctly open, I tried to open the 32976, applying the command tou gave me for the 3389 port, with the following commands but it's still non opened

static (inside,outside) tcp interface 32976 192.168.0.1 32976 netmask 255.255.255.255 0 0

access-list (fromout) permit tcp any any eq 32976

There is probably a gateway

o.melendres — Thu, 22 Oct 2015 13:34:54 GMT

There is probably a gateway doing NAT on the outside interface of the PIX.

Port forwarding rules might be necessary here,

on the outside interface

Dassca1818 — Thu, 22 Oct 2015 14:33:33 GMT

on the outside interface there is only the optic fiber adapter that, I believe, has no nat rules.

Aniway I'll try to speak with provider just to be sure and finally I'll post the answer.

Thanks

Excuse for my late answer but

Dassca1818 — Fri, 20 Nov 2015 11:14:00 GMT

Excuse for my late answer but at last i found where the iussue was.

I configured Pix with the following lines:

static (inside,outside) tcp 10.77.2.76 32976 192.168.0.1 32976 netmask 255.255.255.255 0 0
access-list (fromout) permit tcp any any eq 32976

as I did from the beginning but I didn't realize that the port 32976 wasn't correctly listening on the server cause a defective installation of the software and his virtual lan.

Now all is working and I thank you all.

Dario