topic Port Forwarding Help!! in Network Security

Port Forwarding Help!!

livingdeadbeat — Tue, 12 Mar 2019 00:03:07 GMT

After banging my head on my keyboard for about 3 days straight now I have to ask for help. I am trying to forward specific ports from the outside interface on my ASA5505 to my servers inside and can not get it to work! I have a VPN that currently works and the firewall rule in place I am just overlooking something simple I'm sure. Here is the config:

ASA Version 8.2(5)

hostname ASA

enable password <removed>

passwd <removed>

names

name 172.20.2.4 DC

name 172.20.2.7 VP

name 172.20.2.24 AP

interface Ethernet0/0

switchport access vlan 2

interface Ethernet0/1

interface Ethernet0/2

interface Ethernet0/3

shutdown

interface Ethernet0/4

shutdown

interface Ethernet0/5

shutdown

interface Ethernet0/6

shutdown

interface Ethernet0/7

shutdown

interface Vlan1

nameif inside

security-level 100

ip address 172.20.0.3 255.255.0.0

interface Vlan2

nameif outside

security-level 0

ip address <Public-IP> 255.255.255.252

ftp mode passive

access-list inside_nat0_outbound extended permit ip any 172.20.22.0 255.255.255.192

access-list outside_access_in extended permit tcp any host <Public-IP>eq 2332

access-list outside_access_in extended permit tcp any host <Public-IP>eq 5901

access-list outside_access_in extended permit tcp any host <Public-IP>eq 5500

access-list outside_access_in extended permit tcp any host <Public-IP>eq 5705

access-list outside_access_in extended permit tcp any host <Public-IP>eq 81

pager lines 24

mtu inside 1500

mtu outside 1500

ip local pool VPN-IP-Pool 172.20.22.1-172.20.22.55 mask 255.255.0.0

icmp unreachable rate-limit 1 burst-size 1

no asdm history enable

arp timeout 14400

nat-control

global (outside) 1 interface

nat (inside) 0 access-list inside_nat0_outbound

nat (inside) 1 172.20.0.0 255.255.0.0

static (inside,outside) tcp interface 2332 VP 2332 netmask 255.255.255.255

static (inside,outside) tcp interface 5901 VP 5901 netmask 255.255.255.255

static (inside,outside) tcp interface 5500 VP 5500 netmask 255.255.255.255

static (inside,outside) tcp interface 5705 AP 5705 netmask 255.255.255.255

static (inside,outside) tcp interface 81 AP 81 netmask 255.255.255.255

access-group outside_access_in in interface outside

route outside 0.0.0.0 0.0.0.0 X.X.X.X 1

timeout xlate 3:00:00

timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02

timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00

timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00

timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute

timeout tcp-proxy-reassembly 0:01:00

timeout floating-conn 0:00:00

dynamic-access-policy-record DfltAccessPolicy

aaa-server Radius protocol radius

aaa-server Radius (inside) host 172.20.0.3

timeout 5

key *****

aaa-server Radius (inside) host DC

timeout 5

key *****

aaa authentication ssh console LOCAL

aaa authentication http console LOCAL

aaa authentication telnet console LOCAL

http server enable

http 172.20.0.0 255.255.0.0 inside

no snmp-server location

no snmp-server contact

snmp-server enable traps snmp authentication linkup linkdown coldstart

crypto ipsec transform-set ESP-AES-256-MD5 esp-aes-256 esp-md5-hmac

crypto ipsec transform-set ESP-DES-SHA esp-des esp-sha-hmac

crypto ipsec transform-set ESP-3DES-SHA esp-3des esp-sha-hmac

crypto ipsec transform-set ESP-DES-MD5 esp-des esp-md5-hmac

crypto ipsec transform-set ESP-AES-192-MD5 esp-aes-192 esp-md5-hmac

crypto ipsec transform-set ESP-3DES-MD5 esp-3des esp-md5-hmac

crypto ipsec transform-set ESP-AES-256-SHA esp-aes-256 esp-sha-hmac

crypto ipsec transform-set ESP-AES-128-SHA esp-aes esp-sha-hmac

crypto ipsec transform-set ESP-AES-192-SHA esp-aes-192 esp-sha-hmac

crypto ipsec transform-set ESP-AES-128-MD5 esp-aes esp-md5-hmac

crypto ipsec transform-set VPN esp-des esp-sha-hmac

crypto ipsec transform-set VPN mode transport

crypto ipsec transform-set TRANS_ESP_3DES_SHA esp-3des esp-sha-hmac

crypto ipsec transform-set TRANS_ESP_3DES_SHA mode transport

crypto ipsec transform-set l2tp-transform esp-3des esp-sha-hmac

crypto ipsec transform-set l2tp-transform mode transport

crypto ipsec transform-set vpn-transform esp-aes-256 esp-sha-hmac

crypto ipsec security-association lifetime seconds 28800

crypto ipsec security-association lifetime kilobytes 4608000

crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 set pfs group1

crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 set transform-set ESP-AES-128-SHA ESP-AES-128-MD5 ESP-AES-192-SHA ESP-AES-192-MD5 ESP-AES-256-SHA ESP-AES-256-MD5 ESP-3DES-SHA ESP-3DES-MD5 ESP-DES-SHA ESP-DES-MD5

crypto dynamic-map dyn-map 10 set transform-set l2tp-transform vpn-transform

crypto dynamic-map dyn-map 10 set reverse-route

crypto map outside_map 65535 ipsec-isakmp dynamic SYSTEM_DEFAULT_CRYPTO_MAP

crypto map vpn-map 10 ipsec-isakmp dynamic dyn-map

crypto map vpn-map interface outside

crypto isakmp enable outside

crypto isakmp policy 10

authentication pre-share

encryption 3des

hash sha

group 2

lifetime 28800

crypto isakmp policy 15

authentication pre-share

encryption aes-256

hash sha

group 2

lifetime 86400

crypto isakmp policy 30

authentication pre-share

encryption 3des

hash sha

group 2

lifetime 86400

crypto isakmp policy 50

authentication crack

encryption 3des

hash sha

group 2

lifetime 86400

crypto isakmp policy 65535

authentication pre-share

encryption 3des

hash sha

group 2

lifetime 86400

telnet 172.20.0.0 255.255.0.0 inside

telnet timeout 5

ssh 172.20.0.0 255.255.0.0 inside

ssh timeout 20

console timeout 0

threat-detection basic-threat

threat-detection statistics access-list

no threat-detection statistics tcp-intercept

webvpn

group-policy DefaultRAGroup internal

group-policy DefaultRAGroup attributes

dns-server value 172.20.2.4

vpn-tunnel-protocol l2tp-ipsec

default-domain value hq.vertique.com

username admin password <removed> privilege 15

tunnel-group DefaultRAGroup general-attributes

address-pool VPN-IP-Pool

authentication-server-group Radius

default-group-policy DefaultRAGroup

tunnel-group DefaultRAGroup ipsec-attributes

pre-shared-key *****

isakmp keepalive disable

tunnel-group DefaultRAGroup ppp-attributes

no authentication chap

authentication ms-chap-v2

class-map inspection_default

match default-inspection-traffic

policy-map type inspect dns preset_dns_map

parameters

message-length maximum client auto

message-length maximum 512

policy-map global_policy

class inspection_default

inspect dns preset_dns_map

inspect ftp

inspect h323 h225

inspect h323 ras

inspect ip-options

inspect netbios

inspect rsh

inspect rtsp

inspect skinny

inspect esmtp

inspect sqlnet

inspect sunrpc

inspect tftp

inspect sip

inspect xdmcp

service-policy global_policy global

prompt hostname context

no call-home reporting anonymous

call-home

profile CiscoTAC-1

no active

destination address http https://tools.cisco.com/its/service/oddce/services/DDCEService

destination address email callhome@cisco.com

destination transport-method http

subscribe-to-alert-group diagnostic

subscribe-to-alert-group environment

subscribe-to-alert-group inventory periodic monthly

subscribe-to-alert-group configuration periodic monthly

subscribe-to-alert-group telemetry periodic daily

Thanks in advance for any input!

Port Forwarding Help!!

jayturish — Tue, 02 Oct 2012 20:22:23 GMT

Your first rules look funky. Are you doing one to one NAT or one to many NAT?

If you are just using your outside IP as your public and port forwarding to one or more internal hosts, your lines should look like this:

object-group service DM_INLINE_TCP_1 tcp

port-object eq 15961

port-object eq 88

port-object eq 9000

access-list outside_access_in extended permit icmp any any

access-list outside_access_in extended permit tcp any any object-group DM_INLINE_TCP_1

static (inside,outside) udp interface 15961 172.16.0.3 15961 netmask 255.255.255.255

static (inside,outside) tcp interface 15961 172.16.0.3 15961 netmask 255.255.255.255

static (inside,outside) tcp interface 88 172.16.0.3 88 netmask 255.255.255.255

static (inside,outside) tcp interface 67 172.16.0.3 67 netmask 255.255.255.255

static (inside,outside) tcp interface 68 172.16.0.3 68 netmask 255.255.255.255

static (inside,outside) tcp interface 9000 172.16.0.3 9000 netmask 255.255.255.255

and your inside NAT statement also is wierd

here is mine

global (inside) 1 interface

global (outside) 1 interface

nat (inside) 1 0.0.0.0 0.0.0.0

Port Forwarding Help!!

Jennifer Halim — Tue, 02 Oct 2012 20:24:31 GMT

Your static PAT configuration and access-list looks correct to me.

Are you getting any hitcount on the access-list?

Are you able to telnet on those ports from the internet?

If you try to change it to the following (ie: using the interface keyword instead of the actual IP):

access-list outside_access_in extended permit tcp any interface outside eq 2332

access-list outside_access_in extended permit tcp any interface outside eq 5901

access-list outside_access_in extended permit tcp any interface outside eq 5500

access-list outside_access_in extended permit tcp any interface outside eq 5705

access-list outside_access_in extended permit tcp any interface outside eq 81

does it work?

Port Forwarding Help!!

livingdeadbeat — Tue, 02 Oct 2012 20:29:55 GMT

The traffic does hit the firewall rule and still does not work with the change mentioned with the desired service or ssh over these ports. This is a many to one NAT with the single public IP.

Port Forwarding Help!!

livingdeadbeat — Tue, 02 Oct 2012 20:32:35 GMT

I am using the ASA version 8.2(5) and the ASDM version 6.4(5) with this config.

Port Forwarding Help!!

Jennifer Halim — Tue, 02 Oct 2012 20:32:39 GMT

If the traffic does hit the firewall rule, can you pls share the output of :

show conn | i

Is there any firewall or access rules on the server itself that prevents inbound/incoming connection from the internet?

Port Forwarding Help!!

livingdeadbeat — Tue, 02 Oct 2012 20:41:50 GMT

The output of the show conn | i is blank ...

When I do a packet trace I get the following

VTQFW# packet-tracer input outside tcp 2332 172.20.2.7 2332 detailed

Phase: 1

Type: ACCESS-LIST

Subtype:

Result: ALLOW

Config:

Implicit Rule

Additional Information:

Forward Flow based lookup yields rule:

in id=0xc97cbed8, priority=1, domain=permit, deny=false

hits=60899, user_data=0x0, cs_id=0x0, l3_type=0x8

src mac=0000.0000.0000, mask=0000.0000.0000

dst mac=0000.0000.0000, mask=0100.0000.0000

Phase: 2

Type: ROUTE-LOOKUP

Subtype: input

Result: ALLOW

Config:

Additional Information:

in 172.20.0.0 255.255.0.0 inside

Phase: 3

Type: ACCESS-LIST

Subtype:

Result: DROP

Config:

Implicit Rule

Additional Information:

Forward Flow based lookup yields rule:

in id=0xc97d2af0, priority=500, domain=permit, deny=true

hits=0, user_data=0x6, cs_id=0x0, reverse, flags=0x0, protocol=0

src ip=, mask=255.255.255.255, port=0

dst ip=0.0.0.0, mask=0.0.0.0, port=0, dscp=0x0

Result:

input-interface: outside

input-status: up

input-line-status: up

output-interface: inside

output-status: up

output-line-status: up

Action: drop

Drop-reason: (acl-drop) Flow is denied by configured rule

Port Forwarding Help!!

Jennifer Halim — Wed, 03 Oct 2012 03:50:32 GMT

When you use the packet-tracer, the destination ip address should be the ASA outside interface IP, not the private IP/real IP of the server, because when you actually connect from the internet/outside, you would be connecting to the public IP/NATed IP, not the private IP.

Here is how you should run the packet tracer:

packet-tracer input outside tcp 2332 2332 detailed

Port Forwarding Help!!

livingdeadbeat — Wed, 03 Oct 2012 14:28:12 GMT

After using the correct syntax with the trace the traffic is allowed through the firewall ...

Result:

input-interface: outside

input-status: up

input-line-status: up

output-interface: inside

output-status: up

output-line-status: up

Action: allow

Port Forwarding Help!!

Jennifer Halim — Wed, 03 Oct 2012 20:39:31 GMT

Excellent, good to hear it's working correctly now.

Pls kindly mark the post answered so others can learn from it. Thank you.

Port Forwarding Help!!

livingdeadbeat — Thu, 04 Oct 2012 13:34:41 GMT

The issue is still there. The traffic has always traversed the firewall, i was just using packet tracer incorrectly in troubleshooting. It almost has to be some thing in the NATing at this point doesn't it?

Port Forwarding Help!!

Jennifer Halim — Thu, 04 Oct 2012 13:38:05 GMT

If the issue is still there, i can assure you that it is not the ASA at this point.

If you use packet tracer and it allows the traffic through, then the ASA configuration is OK.

I would be looking into the server itself to see if there is any firewall on the server itself that might be preventing inbound connection from the internet.

Port Forwarding Help!!

livingdeadbeat — Thu, 04 Oct 2012 13:40:20 GMT

I can ssh into the server from the internet using a second gateway we currently have (and phasing out once this is resolved) so it is not the server as far as I can see it. Now you understand why I am so perplexed!

Port Forwarding Help!!

Jennifer Halim — Thu, 04 Oct 2012 13:45:44 GMT

In that case, the default gateway of the server is pointing to the second gateway and the return traffic from the server doesn't pass through this particular ASA.

Port Forwarding Help!!

livingdeadbeat — Thu, 04 Oct 2012 14:14:56 GMT

Shouldn't the server respond back to the ASA since it initiated the request? I don't have the server set to send all traffic through the other gateway ...

A default gateway is the node on the computer network that the network software uses when an IP address does not match any other routes in the routing table.

Port Forwarding Help!!

Jennifer Halim — Thu, 04 Oct 2012 14:23:58 GMT

yup, you can't possibly have all the internet routes configured on the server, so yes, the server will definitely use default gateway to route back the traffic.

And no, it is not how the server would respond back to the same ASA where the traffic is coming from. Server will respond back by routing via its default gateway since the traffic is from the internet, it will use a default gateway coz you couldn't possibly configure static routes or have the whole internet in your server routing table.

As a test, just configure the server default gateway to point to this ASA, i am sure you will be able to access it from the internet with no issue.

Port Forwarding Help!!

livingdeadbeat — Fri, 05 Oct 2012 16:21:53 GMT

Thank you for the help! I knew it was something overly simple and stupid I was overlooking!