RV180 Port Forwarding

[anaushahi]

I am trying to set up RV180 @ 2 locations. I have setup Port forwarding for Remote Desktop 3389 (Defined as a custom srvice), FTP and HTTP. When I try to access these services from within LAN it works fine, however from any other location only FTP works and RDP and HTTP are rejected. I have a static IP address. I have tried with both Port Forwarding as well as Access Rules. Please help ASAP.

Operation succeeded

Port Forwarding Rule Table

	Action	Service	Status	Source IP	Destination IP	Internal Port
	Always Allow	HTTP	Enabled	Any	192.168.2.50	80
	Always Allow	FTP	Enabled	Any	192.168.2.160	21
	Always Allow	RDP	Enabled	Any	192.168.2.163	3389

Access Rule Table

	Action	Service	Status	Connection Type	Source IP	Destination IP
	Always Allow	HTTP	Enabled	Inbound (WAN (Internet) > LAN (Local Network))	Any
	Always Allow	FTP	Enabled	Inbound (WAN (Internet) > LAN (Local Network))	Any
	Always Allow	RDP	Enabled	Inbound (WAN (Internet) > LAN (Local Network))	Any

[bernard999]

Clayton,

I am replacing an RVS4000 with an RV180, and I'm trying to just duplicate the port forwarding as much as possible between the two. Please excuse the neophyte questions, but here they are:

The RVS4000 has a field for "External Port," and no equivalent to the RV180's field "Source IP." And the RV180 has no "External Port" field. How is the external port defined in the RV180? Is it always the same as the internal port?

It's funny that RDC seems to be a popular service, but there is no such entry in the default services list and it must be added as a custom service.

As a side note, page 135 of the RV180 pdf manual omits "Web Access" and "Remote Management," the latter being needed to setup QuickVPN. Also, the pdf Bookmarks are a mess in this document; their heirachies are completely wrong.

Thanks,

Bernard

[csill]

Hi Bernard,

     The first step you will need to do is go under firewall and go under advance settings and click on custom service. You will create a TCP port for 3389, start port is 3389 and end port is 3389. Once you create your custom service then you will need to go to either access rule or port forwarding (weather you create it under access rule or port forwarding they get added to both sections). For this set up, we will go under port forwarding. Once you are under the port forwarding section then you will select your custom service you created from the drop down box (any custom service you create will be at the bottom of the list). Just make sure you action is set to always allow and your destination ip address is were you are wanting to RDP into and your internal port would need to be 3389.

Not sure if you are using port forward for RDP but just using it for part of the example.

Let me know if you have any questions. If all else fail you are welcome to call us at 866-606-1866 all the Cisco Small Business Center.

[bernard999]

Clayton,

Thank you very much. It worked great right from the get go. And it's much faster than the RVS4000. I'm curious to hear the diagnosis of the port forwarding trouble that others have encountered.

Yes, I'm using Windows RDC.

Cheers,

Bernard

[bernard999]

Clayton,

One wrinkle:

On the RV180, when I forward port 443 to our NAS server, in order to make available its browser-based file-server to offsite clients, my QuickVPN now fails to connect. Disabling port 443 forwarding restores QuckVPN functionality. What is the best workaround? This problem didn't happen with the old VRS4000.

Thanks,

Bernard

[Tom Watts]

Bernard, set the QVPN port for 60443 and see if that helps.

-Tom
Please rate helpful posts

[bernard999]

Tom,

I did try changing the drop-down port selection in the QuickVPN client from Auto to 60443, but it still will not connect when 443 is forwarded to the NAS on the RV180.

Question: I notice that Remote Management needs to be enabled to use port forwarding, and its default port is 443. Does this have any bearing on the problem?

Thanks,

Bernard

[Te-Kai Liu]

QuickVPN Client uses either port 443 or 60443. If you need to forward port 443 to a NAS server, you have to enable Remote Management at port 60443 so that all features (NAS, QuickVPN, and remote management) can work well together.

[bernard999]

Tekliu,

I have done that, and the connection process now proceeds farther. It gets past Activating Policy... but hangs at Verifying Network... After that the "Info/The remote gateway is not responding. Do you want to wait?" dialog box pops up. And waiting doesn't help. I've tried both Auto and 60443 in the "Port for VPN" client dialog box. With 60443 only "Server's certificate doesn't exist on your local computer" pops up only once instead of twice.

Any further thoughts would be most welcome.

Thanks,

Bernard

[Te-Kai Liu]

I have done that, and the connection process now proceeds farther. It gets past Activating Policy... but hangs at Verifying Network... After that the "Info/The remote gateway is not responding. Do you want to wait?" dialog box pops up. And waiting doesn't help.

The pop-up "remote gateway is not responding" indicated that QuickVPN client cannot ping the LAN IP of RV180, which could be caused by the Windows firewall on the computer that QuickVPN clients running on. To verify this, you can do the following:

While the pop-up is on, try to access other computers in the LAN of RV180 using their LAN IP addresses. This is to test whether the tunnel is actually up or not. If the tunnel is up, you can actually leave the pop-up message there, and the tunnel will stay up. If the tunnel is not up, you would need to verify if the IKE/IPsec handshake has occurred perhaps with a packet capture. This task can be assisted by an engineer when you contact the small business support center.

[bernard999]

One additional clue: Not surprisingly, with 60443, it behaves the same regardless of whether 443 is forwarded or not.

[bernard999]

Here's the log file, which looks similar to those listed in earlier threads:

2012/09/02 16:43:22 [DEBUG]Input VPN Server Address = redacted

2012/09/02 16:43:23 [STATUS]Connecting to remote gateway with IP address: redacted

2012/09/02 16:43:23 [WARNING]Server's certificate doesn't exist on your local computer.

2012/09/02 16:43:26 [STATUS]Remote gateway was reached by https ...

2012/09/02 16:43:26 [STATUS]Provisioning...

2012/09/02 16:43:35 [STATUS]Success to connect.

2012/09/02 16:43:35 [STATUS]Tunnel is configured. Ping test is about to start.

2012/09/02 16:43:35 [STATUS]Verifying Network...

2012/09/02 16:43:41 [WARNING]Failed to ping remote VPN Router!

2012/09/02 16:43:43 [WARNING]Failed to ping remote VPN Router!

2012/09/02 16:43:46 [WARNING]Failed to ping remote VPN Router!

2012/09/02 16:43:49 [WARNING]Failed to ping remote VPN Router!

2012/09/02 16:43:52 [WARNING]Failed to ping remote VPN Router!

2012/09/02 16:43:54 [WARNING]Ping was blocked, which can be caused by an unexpected disconnect.

2012/09/02 16:44:11 [STATUS]Disconnecting...

2012/09/02 16:44:15 [STATUS]Success to disconnect.

2012/09/02 16:44:30 [STATUS]OS Version: Windows 7

I do have the newest version of QuickVPN. My RV180 firmware is 1.0.1.9

So I'm wondering, Why does it work on 443, except when that port is forwarded, but not on 60443?

Thanks again,

Bernard

[Te-Kai Liu]

>So I'm wondering, Why does it work on 443, except when that port is forwarded, but not on 60443?

If port 443 works for you before (without port forwarding to NAS), there is no reason that port 60443 (with forwarding 443 to NAS) would not work for you. You might want to contact the Support center for futher assistance.

[bernard999]

Tekliu,

I tried leaving the pop-up open and accessing the LAN as you suggested, but no luck. I have RDC access into the system and can see in the RV180's IPsec Connection Status that there are no connections. I guess it's down to calling in a ticket.

Thanks,

Bernard

[Te-Kai Liu]

Yes, please give them a call. An engineer can try a QuickVPN connection from his/her computer to isolate any client-side issue.

[bernard999]

Just a final note: I see in the thread https://supportforums.cisco.com/thread/2022966 that the last post shows a similar fact pattern as mine. The ONLY way he got QuickVPN to work is via 443. He closes with "Cisco needs to address the port confilict so 443 can be forwarded for other uses." Here we are nearly 2 years on, locked in battle with the same demon.