Hi,
With the ACL list you have provided (and acl 'in' statement under the SSH section) do I still require a NAT statement for my dialer0 interface to my 192.168.1.1 router address or is the NAT statement not required - does the ACL work without? What should the NAT statement be if so?
You won't need NAT because you'll be sshing to the public IP of your router.
You will need to ssh to FQDN provided by no-ip.org or dyndns.org because you have a dynamic IP through PPP.
here is a thread discussing the dyndns configuration: https://supportforums.cisco.com/thread/2167081
Yes that would be great if you can give me the basic firewall and PAT information as I will want to do this as well. (I'll likely be having a web server so allowing 80 and 443 but to restricted sites. The web server will eventually sit on 192.168.1.2
here is a config example for the static PAT:
int vlan1
ip nat inside
int dialer0
ip nat outside
ip nat inside source static tcp 192.168.1.2 80 interface dialer0 80
ip nat inside source static tcp 192.168.1.2 443 interface dialer0 4430
no ip http server
ip http secure-server
I would also like to allow HTTPS as well as SSH so we can view the web interface as well as PING to perform a basic check - again these need to be restricted to the 2 internet IPs - the destination will be the router IP of 192.168.1.1
for securing https access to router you can use the same access-class like this:
ip http access-class 10
Now for firewall config,you could do something like this:
ip access-list extended Outside-Inside-acl
permit tcp host x.x.x.x host 192.168.1.2 eq https
permit tcp host x.x.x.x host 192.168.1.2 eq http
ip access-list extended Outside-Mgmt-acl
permit tcp host x.x.x.x any eq 443
permit tcp host x.x.x.x any eq 22
permit tcp host y.y.y.y any eq 443
permit tcp host y.y.y.y any eq 22
zone security Inside
zone security Outside
int vlan1
zone-member security Inside
int dialer 0
zone-member security Outside
class-map type inspect match-any Inside-Outside-class
match protocol tcp
match protocol udp
match protocol icmp
class-map type inspect match-any Outside-Inside-class
match access-group name Outside-Inside-acl
class-map type inspect match-any Outside-Mgmt-class
match access-group name Outside-Mgmt-acl
policy-map type inspect Inside-Outside-policy
class type inspect Inside-Outside-class
inspect
class class-default
drop
policy-map type inspect Outside-Inside-policy
class type inspect Outside-Inside-class
inspect
class class-default
drop
policy-map type inspect Outside-Mgmt-policy
class type inspect Outside-Mgmt-class
inspect
class class-default
drop
zone-pair security Outside-Inside source Outside destination Inside
service-policy type inspect Outside-Inside-policy
zone-pair security Inside-Outside source Inside destination Outside
service-policy type inspect Inside-Outside-policy
zone-pair security Outside-self source Outside destination self
service-policy type inspect Outside-Mgmt-policy
Regards
Alain
Don't forget to rate helpful posts.
Don't forget to rate helpful posts.
