ASA 5510 only allows 1 specific port to open, no others work.

[tater0214]

Hi, I have a Cisco ASA 5510 running as a firewall and hosting AnyConnect. Behind that is a server running True NAS which hosts a variety of things. Currently I have it setup with a plex server and the port forwarding works as expected however I would like to add more services (like a Minecraft server) which need to be forwarded. I've tried many things including what worked for plex and also changing the port number in the known good config and it breaks it but changing back to 32400 works again. Any ideas of what is happening?  I have attached the config below, Thanks

[Flavio Miranda]

@tater0214 

 Create an object and add all the services inside and then use the object on the rule instead the port . It seems you are creating some conflict by duplicating the rule.

[Aref Alsouqi]

Let's assume that Minecraft server has the IP 192.168.3.50 and you want to open the inbound connection for its port 50000, something similar to this should work and wouldn't affect the existing config for Truenas-plex server:

object network Minecraft
   host 192.168.3.50
   nat (Inside,outside) static interface service tcp 50000 50000

access-list plexport extended permit tcp any object Minecraft eq 50000

[tater0214]

If i wanted to add multiple ports to 192.168.3.50 how would i do that? for instance 50000 and 60000. And if i needed udp on port 0000 how would I do that?

[Aref Alsouqi]

In that case you would need to create multiple manual NAT rules. For instance, you can create the service objects of the ports you need and then reference them in the manual NAT rules.

object network Minecraft
   no nat (inside,outside) static interface service tcp 50000 50000

object service TCP-50000
   service tcp source eq 50000
object service TCP-60000
   service tcp source eq 60000
object service UDP-0000
   service udp source eq 0000

nat (inside,outside) source static Minecraft interface service TCP-50000 TCP-50000
nat (inside,outside) source static Minecraft interface service TCP-60000 TCP-60000
nat (inside,outside) source static Minecraft interface service UDP-0000 UDP-0000

access-list plexport extended permit tcp any object Minecraft eq 50000
access-list plexport extended permit tcp any object Minecraft eq 60000
access-list plexport extended permit udp any object Minecraft eq 0000

[MHM Cisco World]

object network Minecraft
   host 192.168.3.50
   nat (Inside,outside) static interface service tcp <service object port> <service object port>

Above you can config ad much as you want 

Only change service object for each NAT

MHM