cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
3291
Views
0
Helpful
9
Replies

Opening a port on a 4321

From what I’ve managed to read in various threads that a search returned, I need to “forward a port.”

Problem is that none of the following threads I read:

 

https://community.cisco.com/t5/routing/port-forwarding-nat/td-p/2102914
https://community.cisco.com/t5/switching/cisco-4331-router-port-forwarding-outside-nat-not-pinging/td-p/3082126
https://community.cisco.com/t5/switching/how-to-enable-port-forwarding-to-get-some-tcp-services/td-p/2817115
https://community.cisco.com/t5/routing/port-forwarding/td-p/1490550

 

Make any sense to me whatsoever – I understand absolutely nothing about they are talking about.

 

For example, in the first link someone gives an example of YY as the interface dialer number – problem is when I tried that example, I have no clue at to what number my dialer is/what I should use, of it applies to me even though my understanding is that my PPPoE interface that is connected with an ethernet patch cable is still called ‘a dialer’. (I literally typed in YY the first time I tried it.)]

 

I need to open ports 81, 8001, and 10554 on a 4321 and I am desperate and at my wits end.

 

Is there an IOS command that goes like this “open port 8001”? (This is the level of simplicity that I need.)

 

Below is my current running config (and I don’t even understand what 99% of it means – I trying to communicate that if anyone can help, please keep it very very simple.)

 

This is so that the boss can access the security cameras from whatever location he is at.

 

- The NVR’s IP address is 192.168.2.234

- The Gateway/Router’s address is 192.168.2.254 on GigabitEthernet0/0/1 and the IP address of the store is whatever the ISP assigns when the unit is rebooted on occasion due to a power outage etc.

 

There may have been an attempt to open port 8001 but I don't know if any 'code snippets' are left over in the follow config from that attempt, but I know that the attempt did not work:

 

 

Carlton_Router#show config
Using 2411 out of 33554432 bytes
!
! Last configuration change at 15:47:16 GMT Mon Jul 2 2018 by admin
!
version 15.5
service timestamps debug datetime msec
service timestamps log datetime msec
no platform punt-keepalive disable-kernel-core
!
hostname Carlton_Router
!
boot-start-marker
boot system flash bootflash:isr4300-universalk9.03.16.07b.S.155-3.S7b-ext.SPA.bin
boot-end-marker
!
!
vrf definition Mgmt-intf
 !
 address-family ipv4
 exit-address-family
 !
 address-family ipv6
 exit-address-family
!
enable secret 5 $1$d2AV$.x62c8AIL9dVKFN/m1Q61.
enable password Xxxxx
!
no aaa new-model
ethernet lmi global
no process cpu autoprofile hog
clock timezone GMT -5 0
!
!
!
!
!
!
!
!
!
!
!

 

no ip dhcp conflict logging
ip dhcp excluded-address 192.168.2.254
!
ip dhcp pool Carlton
 network 192.168.2.0 255.255.255.0
 default-router 192.168.2.254
 dns-server 8.8.8.8
!
!
!
!
!
!
!
!
!
!
subscriber templating
multilink bundle-name authenticated
!
!
!
!
license udi pid ISR4321/K9 sn FDO21112KP2
!
spanning-tree extend system-id
!
username admin privilege 15 secret 5 $1$w/4P$sd2z6NvcAOHTKWR.QHRzU0
!
redundancy
 mode none
!
!
no cdp run
!
!
!
!
!
!
interface GigabitEthernet0/0/0
 ip address 192.168.2.254 255.255.255.0
 ip nat inside
 negotiation auto
!
interface GigabitEthernet0/0/1
 no ip address
 negotiation auto
 pppoe enable group global
 pppoe-client dial-pool-number 1
!
interface GigabitEthernet0
 vrf forwarding Mgmt-intf
 ip address 192.168.2.245 255.255.255.0
 negotiation auto
 no cdp enable
!
interface Dialer1
 ip address negotiated
 ip nat outside
 encapsulation ppp
 ip tcp adjust-mss 1452
 dialer pool 1
 ppp authentication chap pap callin
 ppp chap hostname dlftzcr3@bellnet.ca
 ppp chap password 0 nVSLJRc4
 ppp pap sent-username dlftzcr3@bellnet.ca password 0 nVSLJRc4
 no cdp enable
!
ip nat inside source list NAT interface Dialer1 overload
ip forward-protocol nd
ip http server
ip http authentication local
no ip http secure-server
ip tftp source-interface GigabitEthernet0
ip route 0.0.0.0 0.0.0.0 Dialer1
!
!
ip access-list extended NAT
 permit icmp 192.168.2.0 0.0.0.255 any
 permit udp 192.168.2.0 0.0.0.255 any
 permit tcp 192.168.2.0 0.0.0.255 any
!
access-list 101 permit ip any any
!
snmp-server community public RO
!
!
control-plane
!
!
line con 0
 exec-timeout 0 0
 stopbits 1
line aux 0
 stopbits 1
line vty 0 4
 privilege level 15
 login local
 transport input telnet
 transport output telnet
!
!
end

Carlton_Router#

 

 

Thank you in advance for any help.

9 Replies 9

balaji.bandi
Hall of Fame
Hall of Fame

Need some clarification here :

 

You want to open below ports from Internet to internal network to this IP (NVR’s IP address is 192.168.2.234) ?

 

I need to open ports 81, 8001, and 10554 on a 4321

 

From where your boss try to access (NVR’s IP address is 192.168.2.234)  from internet or from LAN ? 

BB

***** Rate All Helpful Responses *****

How to Ask The Cisco Community for Help


@balaji.bandi wrote:

Need some clarification here :

 

You want to open below ports from Internet to internal network to this IP (NVR’s IP address is 192.168.2.234) ?

 

I need to open ports 81, 8001, and 10554 on a 4321

 

From where your boss try to access (NVR’s IP address is 192.168.2.234)  from internet or from LAN ? 


Internet - from anywhere in the world (he vacations a lot.)
 
No one cares about accessing it on the Lan as that the NVR has a screen attached to it in the manager's office - but it works via HTTP on port 81 with a Browser Plugin on the computer in the store as that I tested it to make sure that that works. Also, I don't think that the app which uses Port 8001 is intended to work on the Lan. (Port 81 does not work trying to access it from the internet with a browser.)
 
As for the third port, (RTSP Port 10554) I have no clue if it's needed (or what it does), it's just listed on the network access configuration screen along with ports 81 and 8001.
 
It's an app from HIKvision that runs on his iPad & iPhone and a program for his Mac when he is home.

salemmahara
Level 3
Level 3
 

For some reason I can't see the text of your message here (but it is the email that notified me you responded.)

 

I'll C&P the relevant portion from the email:

 

"ip nat inside source static tcp 192.168.2.240 80 interface dialer 1 80
In this example we told the router to publish 192.168.2.240:80 as negotiatedIPFromISP:80
It means, if external users browse:  http://yourPublishIP , they'll see your web site."

 

My response to the above I pray that it works:

 

It's not a website but a HIKVision security camera system NVR.
 
Did not know that any private info was there (I thought I took out the one reference - like I said, I have no clue what most of that stuff means.)
 
Also, I'm going to guess that the "80" in your example needs to be changed to "81" to work for me? (If not I need to know.) While the default for the NVR is 80, I had to change it to 81 as the server in the store is using port 80 to send the daily accounting information to a central unit (which location I will also have to open port 80 on when I get around to getting the boss to spring for a 4321 at that location) and if the NVR is on port 80 it does not work for some reason (don't know why that connection doesn’t work as that the connection is outgoing with its own static target IP address - but it is what it is. Found this out at a store location that has a $30 router that just lets me open ports without any grief - thing is the IP telephone provider we are switching each store to claims they will not support cheaper routers and we had very good luck with an old Cisco 500 (I think it was a 500 something) series router that the boss's store location so we decided to go Cisco for the new units)
 
I'm also going to assume that I need to duplicate those command for the other port numbers?
 
The one thing that concerns me with this port forwarding, versus just opening a port, is that I found out the hard way that unless certain ports in the 400's (I forget which ones exactly, but one of the examples/threads here that I read had a similar problem) Outlook will not allow one to forward or respond to an email message - a "new message" has to be created using a C&P of the message wanting to be forwarded or replied to and then sent as a new message (royal pain in the …), BUT, and this is a big but, the IP addresses of those computers can vary depending on which order they, and every other piece of equipment on the Lan, is booted in. I just want the port open without having to create individual port forwarding entries for around 200 potential IP addresses for every port I need opened.
 
On my router at home, I just tell it what ports I want open, and they are open - it takes me literally 30 seconds. THAT is what I need.
 
I also do maintenance and by that I mean fixing toilets, replacing broken hot water heaters, replacing broken taps, retiling older floors, hanging new signs etc. - I do not have the time to key in a thousand entries per router (I'm also a one finger typist.)
 
One reason I'm late in responding to some of my questions here is that I don’t get to that store location for weeks some time (tomorrow I'm going to have to wake up at 4am so I can get to that location to enter the commands you have shown me to see if they work because I'm scheduled to be at another store at 7am to replace the hot water heater mentioned above.)

Where is the text??? :)))

 

Yes. I just wanted to explain STATIC NAT with a simple example.

 

You should change ports to your own. Sometimes you can Listen on different port and redirect it to other one ( some technical and security reasons ). Ex:

 

Ip nat inside source static tcp 192.168.2.1 443 interface dialer 1 8080

 

This means : You listen on port 8080 and redirect it to 443 ( It's just an example. Try to forget it if you are a beginner )

 

Again, YES. If you have different ports, you can have different NAT Statement.

Did not work. Below are the commands I entered (the "$" at the start of the port 10544 command line is TeraTerm "shrinking" the line on the display - the full "ip nat inside source static tcp" text is still there):
 
Carlton_Router#
Carlton_Router#conf t
Enter configuration commands, one per line.  End with CNTL/Z.
Carlton_Router(config)#ip nat inside source static tcp 192.168.2.231 81 interface dialer 1 81
Carlton_Router(config)#ip nat inside source static tcp 192.168.2.231 8001 interface dialer 1 8001
Carlton_Router(config)#
Carlton_Router(config)#$ 192.168.2.231 10554 interface dialer 1 10554
Carlton_Router(config)#
Carlton_Router(config)#exit
Carlton_Router#
(I also did the "wr" command after the above at the main prompt.)

The test I ran on both ports 81 and 8001 at the following link say that they are still closed: https://www.whatismyip.com/port-scanner/
 
The techs at HIKVision says that their app will not work (no ifs, ands, or buts) unless the above link returns an "open."

You need to give access from right from internet router to end point 

as example :

 

Internet ---DSL you need to forward here ---your local router (same here) -Switch -Camera

 

when you scan it will be dropped at DSL router end.

 

 

BB

***** Rate All Helpful Responses *****

How to Ask The Cisco Community for Help


@balaji.bandi wrote:

You need to give access from right from internet router to end point 

as example :

 

Internet ---DSL you need to forward here ---your local router (same here) -Switch -Camera

 

when you scan it will be dropped at DSL router end.

 

 


And that happens, how?
 
I have no idea on how to even start that, let alone knowing how to go about doing it.
 
I don’t even fully understand what you are saying - an open port should just be an open port. And I have never set up routing through a switch, you plug the device in the switch, the router assigns an IP address, it works. (Except in the case of this router.)
 
Our switches are SG500-48Ps. But I just use them as a generic smart switch with 5 vlans that all (with the exception of the vlan that the cameras and the NVR port that services the cameras are on) meet on/share the port that goes to the router and as far as the router is concerned it is just one big 50 port switch.
 
Also, this app does NOT talk to the cameras, it talks to the NVR through a second port that is on the same vlan as the computers. The NVR then talks to the cameras out another port that it has. I need to talk to the NVR, not to the "camera."
 
Any help would be greatly appreciated.
Thanx in advance.

Bump.

 

Seriously, no one knows how to open a post on a 4321?

Review Cisco Networking products for a $25 gift card