topic Access Windows Server from Outside address in Network Security

Access Windows Server from Outside address

woodjl1650 — Mon, 11 Mar 2019 21:35:10 GMT

I just purchased a domain name, that I have forwarding to my WAN address. I want to be able to access my home websie via this route. I have an ASA 5505, how do I get the ASA to point to the home server when the WAN IP address is entered?

Access Windows Server from Outside address

varrao — Fri, 07 Oct 2011 12:20:05 GMT

Hi Jonathan,

On the ASA 5505, you would need to first create a nat statement for the server, like:

static (inside,outside) 1.1.1.1 192.168.1.1

where 1.1.1.1 is the public ip.

and also create an access-list that needs to be applied on the outside interface, like:

access-list out_in permit tcp any host 1.1.1.1

access-group out_in in interface outside

Hope that helps

Thanks,

Varun

Access Windows Server from Outside address

woodjl1650 — Fri, 07 Oct 2011 12:24:25 GMT

Where do I point it to grab the IP address of the server? The inside address for the server will be 192.168.4.199

Access Windows Server from Outside address

woodjl1650 — Fri, 07 Oct 2011 12:29:39 GMT

I forgot to that I left out ther version: 8.4.1

I recieved this error:

Result of the command: "static (inside,outside) 68.108.xxx.xxx 192.168.1.1"

ERROR: This syntax of nat command has been deprecated..

Access Windows Server from Outside address

varrao — Fri, 07 Oct 2011 12:29:54 GMT

Is the server behind teh ASA inside interface or on the internet (with reference to the ASA) ? Are you accessing this site from the inside interface of the ASA??

Thanks,

Varun

Access Windows Server from Outside address

woodjl1650 — Fri, 07 Oct 2011 12:35:55 GMT

Yes the server is behind the ASA via an additional router. I want to be able to access the server via the inside and the outside.

Cable Modem-----> ASA----> Cisco-Linksys Router-----> Server

I want to be able to access my home server hosting my webiste from my inside network as well as from any outside address. I currently have my domain forwarding to my WAN IP address.

Access Windows Server from Outside address

varrao — Fri, 07 Oct 2011 12:49:27 GMT

OK got it!!!!

Didn't know you were using 8.4, you would need this syntax

object network public_ip

host 1.1.1.1

object network private_ip

host 192.168.4.199

nat (outside,inside) source static any any destination static public_ip private_ip

For accessing from inside:

nat (inside,inside) source static any interface destination static public_ip private_ip

same-security-traffic permit intra-interface

You woudl also need the access-list:

access-list out_in permit tcp any host 192.168.4.199

access-group out_in in interface outside

Hope that helps.

Thanks,

Varun

Access Windows Server from Outside address

woodjl1650 — Fri, 07 Oct 2011 13:01:35 GMT

I get this error when apply it the config

nat (outside,inside) source static any any destination static public_ip private_ip

ERROR: Address 68.108.xxx.xxx overlaps with outside interface address.

ERROR: NAT Policy is not downloaded

Any idea on how to resolve this?

Access Windows Server from Outside address

varrao — Fri, 07 Oct 2011 13:06:00 GMT

Ohhhhh is the public ip you are using the outside interface IP????

Varun

Access Windows Server from Outside address

woodjl1650 — Fri, 07 Oct 2011 13:07:40 GMT

Yes, is that a problem? Can we fix that?

Access Windows Server from Outside address

varrao — Fri, 07 Oct 2011 13:09:37 GMT

We would need to do port forwarding for it, but you would need to tell me on whihc port the server needs to be connected on 80,443 or anything else??

Varun

Access Windows Server from Outside address

woodjl1650 — Fri, 07 Oct 2011 13:11:31 GMT

80, 443, 21 the standard for internet and FTP access

Re: Access Windows Server from Outside address

varrao — Fri, 07 Oct 2011 13:54:28 GMT

You woudl then need to use the following nats:

object network private_ip

host 192.168.4.199

object service tcp_443

service tcp source eq 443

object service tcp_80

service tcp source eq 80

object service tcp_21

service tcp source eq 21

nat (inside,any) source static private_ip interface service tcp_443 tcp_443

nat (inside,any) source static private_ip interface service tcp_80 tcp_80

nat (inside,any) source static private_ip interface service tcp_21 tcp_21

same-security-traffic permit intra-interface

access-list out_in permit tcp any host 192.168.4.199

access-group out_in in interface outside

Hope that works for you

Thanks,

Varun

Access Windows Server from Outside address

woodjl1650 — Fri, 07 Oct 2011 14:00:15 GMT

I get and error on the nat lines

ERROR: "interface" keyword is not allowed when translated interface is any

Any ideas?

Access Windows Server from Outside address

varrao — Fri, 07 Oct 2011 14:17:16 GMT

Let me try this first on my ASA

Varun

Access Windows Server from Outside address

varrao — Fri, 07 Oct 2011 15:19:49 GMT

Hi Jonathan,

I tried a few things and it doesn't work if you are using the outside interface of the ASA, wile accessing it from inside, for outside to inside flow it would work fine, here's the config for it:

object network private_ip

host 192.168.4.199

object service tcp_443

service tcp source eq 443

object service tcp_80

service tcp source eq 80

object service tcp_21

service tcp source eq 21

nat (outside,inside) source static any any destination static interface private_ip service tcp_80 tcp_80

nat (outside,inside) source static any any destination static interface private_ip service tcp_443 tcp_443

nat (outside,inside) source static any any destination static interface private_ip service tcp_21 tcp_21

For accessing the server on outside interface ip, firewall would not allowe that.

Workaround:

Use any other free public ip for it.

Thanks,

Varun

Access Windows Server from Outside address

Julio Carvajal — Sat, 08 Oct 2011 23:00:47 GMT

Hello,

As Varung says, you are going to be able to hit the outside interface of the ASA 5505 on the required ports and then be translated to the inside server only from the inside.

This because the ASA as a security device does not permit traffic going to a distant interface so just as an example if you try to ping the outisde interface of your ASA from the inside host you are not going to get any response.

So in this particular case as Varun said you have to use a different public IP from the outside interface IP, this if you want to access the internal server by a public IP from the internal network.

Hope this helps

Regards,