ASA 5505 Port Forwarding Woahs

[jkesselring77]

I have a recently bought a Cisco ASA 5505 to replace another firewall.   I've done port forwarding form the outside but it appears either im rusty or the configuration has changed.   I'm running firmware 9.2(3)

I have a server 192.168.1.166

I need to forward all requests on the following ranges from the outside (internet) to the inside to the host listed above.

TCP 28000 - 28003

UDP 28000 - 28003

Any help would be greatly appreciated.

The configuration I have is:

!
interface Vlan1
 nameif inside
 security-level 100
 ip address 192.168.1.1 255.255.255.0
!
interface Vlan2
 nameif outside
 security-level 0
 ip address dhcp setroute
!
interface Vlan5
 no nameif
 security-level 50
 no ip address
!
boot system disk0:/asa923-k8.bin
ftp mode passive
object network obj_any
 subnet 0.0.0.0 0.0.0.0
object network LIF_Server
 host 192.168.1.166
object network LIF
 host 192.168.1.166
object service LIF_Server_services_TCP
 service tcp destination range 28000 28003
object service LIF_Server_services_UDP
 service udp destination range 28000 28003
access-list outside_access_in extended permit tcp any host 192.168.1.166 range 28000 28003
access-list outside_access_in extended permit udp any host 192.168.1.166 range 28000 28003
access-list inside_access_out extended deny udp any eq netbios-ns any eq netbios-ns
access-list inside_access_out extended deny tcp any eq netbios-ssn any eq netbios-ssn
access-list inside_access_out extended deny ip host 192.168.1.168 any
access-list outside_access_in_1 extended permit object LIF_Server_services_TCP any interface outside
access-list outside_access_in_1 extended permit object LIF_Server_services_UDP any interface outside
pager lines 24
logging enable
logging asdm informational
mtu inside 1500
mtu outside 1500
icmp unreachable rate-limit 1 burst-size 1
asdm image disk0:/asdm-732.bin
no asdm history enable
arp timeout 14400
no arp permit-nonconnected
nat (inside,outside) source static LIF_Server interface service LIF_Server_services_UDP LIF_Server_services_UDP
nat (inside,outside) source static LIF_Server interface service LIF_Server_services_TCP LIF_Server_services_TCP
!
object network obj_any
 nat (inside,outside) dynamic interface
access-group inside_access_out out interface inside
access-group outside_access_in_1 in interface outside
timeout xlate 3:00:00
timeout pat-xlate 0:00:30
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
timeout tcp-proxy-reassembly 0:01:00
timeout floating-conn 0:00:00
dynamic-access-policy-record DfltAccessPolicy
user-identity default-domain LOCAL
aaa authentication ssh console LOCAL
http server enable
http 192.168.1.0 255.255.255.0 inside
no snmp-server location
no snmp-server contact
c
dhcpd auto_config outside
!
dhcpd address 192.168.1.5-192.168.1.99 inside
dhcpd dns 192.168.1.1 interface inside
dhcpd auto_config outside interface inside
dhcpd enable inside
!
threat-detection basic-threat
threat-detection statistics port
threat-detection statistics protocol
threat-detection statistics access-list
threat-detection statistics tcp-intercept rate-interval 30 burst-rate 400 average-rate 200
username razor password hLVDkWX97SS3icO4 encrypted privilege 15
username admin password GcBy5JGexfhFVK4K encrypted privilege 15
!
class-map inspection_default
 match default-inspection-traffic
!
!
policy-map type inspect dns preset_dns_map
 parameters
  message-length maximum client auto
  message-length maximum 512
policy-map global_policy
 class inspection_default
  inspect dns preset_dns_map
  inspect ftp
  inspect h323 h225
  inspect h323 ras
  inspect rsh
  inspect rtsp
  inspect esmtp
  inspect sqlnet
  inspect skinny
  inspect sunrpc
  inspect xdmcp
  inspect sip
  inspect netbios
  inspect tftp
  inspect ip-options
!
service-policy global_policy global
prompt hostname context
 

[joe19366]

ASA port fowarding nat can be annoying - luckily you only have a few ports to forward. i know some "basic" devices ala linksys can forward 10,000 ports - ASA is not that easy - here is a few to get you started;

!!!The Nats; (i'm using the single Public Interface IP leased by the provider)

object network 192.168.1.119_Inside_TCP_80
 host 192.168.1.119
object network 192.168.1.119_Inside_TCP_1438
 host 192.168.1.119
object network 192.168.1.119_Inside_TCP_3390
 host 192.168.1.119
object network 192.168.1.120_Inside_TCP_21
 host 192.168.1.120
object network 192.168.1.120_Inside_TCP_1436
 host 192.168.1.120
object network 192.168.1.120_Inside_TCP_3389
 host 192.168.1.120

object network 192.168.1.119_Inside_TCP_80
 nat (inside,outside) static interface service tcp www www 
object network 192.168.1.119_Inside_TCP_1438
 nat (inside,outside) static interface service tcp 1438 1438 
object network 192.168.1.119_Inside_TCP_3390
 nat (inside,outside) static interface service tcp 3390 3390 
object network 192.168.1.120_Inside_TCP_21
 nat (inside,outside) static interface service tcp ftp ftp 
object network 192.168.1.120_Inside_TCP_1436
 nat (inside,outside) static interface service tcp 1436 1436 
object network 192.168.1.120_Inside_TCP_3389
 nat (inside,outside) static interface service tcp 3389 3389 

object network EnergyPro2-Inside
 host 192.168.1.119
object network EnergyPro1_Inside
 host 192.168.1.120

!!!the ACL's to actually allow traffic in on the Nat/pat

object-group service EnergyPro1-ports tcp
 port-object eq ftp
 port-object eq 1436
 port-object eq 3389
object-group service EnergyPro2-ports tcp
 port-object eq www
 port-object eq 1438
 port-object eq 3390

access-list outside_allowed_to_inside extended permit tcp any object EnergyPro1_Inside object-group EnergyPro1-ports 
access-list outside_allowed_to_inside extended permit tcp any object EnergyPro2_Inside object-group EnergyPro2-ports 

access-group outside_allowed_to_inside in interface outside

Note: you can just put one host and not a group

object network EnergyPro2-Inside
 host 192.168.1.119
object network EnergyPro1_Inside
 host 192.168.1.120

by doing this

access-list outside_allowed_to_inside extended permit tcp any host 192.168.1.119 object-group EnergyPro1-ports 

remember - asa 8.3 and later want the PRIVATE IP as acl's look at the AFTER nat address