topic Re: Help with Port Forwarding from Outside Address in Network Security

Help with Port Forwarding from Outside Address

chuckmccants — Mon, 11 Mar 2019 16:45:33 GMT

Can someone point me to info on port forwarding from an external address to an internal address. This firewall has a DMZ, but the machine I want to port forward to does not sit in the DMZ. All attempts to solve have lead to my machines in the DMZ not working.

Re: Help with Port Forwarding from Outside Address

resoares — Thu, 03 Dec 2009 20:47:08 GMT

Hi,

Try this command below:

static (inside,outside) tcp 1.1.1.1 www 2.2.2.2 www netmask 255.255.255.255

where 1.1.1.1 = it is your public ip address and 2.2.2.2 it is your internal one ( RFC 1918 ). In this example, the firewall is performing a static PAT for HTTP service. In this case, the reachable ip address for the Internet will be 2.2.2.2

Br,

Re: Help with Port Forwarding from Outside Address

resoares — Thu, 03 Dec 2009 20:48:18 GMT

Sorry, the ip will be 1.1.1.1 to be reachable by Internet

Re: Help with Port Forwarding from Outside Address

chuckmccants — Thu, 03 Dec 2009 21:12:42 GMT

So are you saying:

static (inside,outside) tcp External-IP www Internal-IP www netmask 255.255.255.255

Re: Help with Port Forwarding from Outside Address

resoares — Thu, 03 Dec 2009 21:14:19 GMT

That's correct.

Re: Help with Port Forwarding from Outside Address

chuckmccants — Fri, 04 Dec 2009 18:09:06 GMT

Thanks for the reply, but it didn't work.

Re: Help with Port Forwarding from Outside Address

resoares — Fri, 04 Dec 2009 18:12:41 GMT

Hi,

Be aware that an ACL must allow the traffic comes from Internet to DMZ servers.

Br,

Re: Help with Port Forwarding from Outside Address

chuckmccants — Fri, 04 Dec 2009 18:47:36 GMT

Yes, realize that. But, this is not a DMZ host, it is one that sits on the inside network.

Re: Help with Port Forwarding from Outside Address

resoares — Fri, 04 Dec 2009 18:53:58 GMT

Ok, have you already checked all ACLs for inside and outside directions?

Re: Help with Port Forwarding from Outside Address

chuckmccants — Sat, 05 Dec 2009 16:44:00 GMT

Got it. I added:

access-list Inside_access_out extended permit tcp any host 192.168.14.252 eq www

access-list Inside_access_out extended permit tcp host 192.168.14.252 eq www any

and everything finally worked.

Thanks again for your help.

Chuck

Re: Help with Port Forwarding from Outside Address

resoares — Mon, 07 Dec 2009 22:11:34 GMT

You are welcome.

Best regards,

Renato Saraiva