Simple home setup with Cisco 827 router - Troubleshooting the ACL

[TalonKarrde]

Hi all,

I have a Cisco 827 at home I am using for a DSL gateway/firewall. I have a single dynamic IP and private hosts on the LAN side.

So far, the connection is working, NAT is working, and port redirection (from the net to inside private hosts) is working.

When I enable the firewall through the web interface of this unit, it creates a series of inspect rules, and also an ACL. The inspect rules are applied to the dialer in an outbound direction, and the ACL is applied inbound.

What I have found is that when the ACL is applied, my port forwarding does not work (so I cant access my internal FTP server from the web anymore), but without the ACL inbound, its fine.

I added the following line to the ACL for FTP traffic, but it does not seem to work, so I was wondering if someone could point out what I am doing wrong.

The internal host (ftp server) is 192.168.0.20 if that helps. I also tried specifying that in the ACL instead of any, but still no luck.

The whole ACL is below.

access-list 111 permit tcp any eq ftp any eq ftp

access-list 111 permit tcp any eq 3389 any eq 3389

access-list 111 permit icmp any any administratively-prohibited

access-list 111 permit icmp any any echo

access-list 111 permit icmp any any echo-reply

access-list 111 permit icmp any any packet-too-big

access-list 111 permit icmp any any time-exceeded

access-list 111 permit icmp any any traceroute

access-list 111 permit icmp any any unreachable

access-list 111 permit udp any eq bootps any eq bootpc

access-list 111 permit udp any eq bootps any eq bootps

access-list 111 permit udp any eq domain any

access-list 111 permit esp any any

access-list 111 permit udp any any eq isakmp

access-list 111 deny ip any any

Many thanks!

[vladrac-ccna]

Hello,

did you open a connection to the FTP data as well?

Also you could try to log the ACL and catch what is being denied.

something like:

ip accounting [access-violations]

or log option on the ACL itself

HTH,

rate this post if it does.

Vlad

[TalonKarrde]

I will certainly give that a try and see what happens. FTP was just a test to see if the ports were getting through to the inside.. I can see that it was probably a bad example since it uses so many ports.

I will try the ACL accounting and see if that reveals anything, then try and sort from there.

Will let you know how it goes. Cheers!

[TalonKarrde]

Hi,

I just got home and tried this, but no success.. none of the accounting commands worked for the ACL either, so I am not sure whats going on.

I changed the access list as follows:

access-list 111 permit tcp any host 192.168.0.20 eq ftp

access-list 111 permit tcp any host 192.168.0.20 eq ftp-data

access-list 111 permit tcp any host 192.168.0.20 eq 3389

access-list 111 permit icmp any any administratively-prohibited

access-list 111 permit icmp any any echo

access-list 111 permit icmp any any echo-reply

access-list 111 permit icmp any any packet-too-big

access-list 111 permit icmp any any time-exceeded

access-list 111 permit icmp any any traceroute

access-list 111 permit icmp any any unreachable

access-list 111 permit udp any eq bootps any eq bootpc

access-list 111 permit udp any eq bootps any eq bootps

access-list 111 permit udp any eq domain any

access-list 111 permit esp any any

access-list 111 permit udp any any eq isakmp

access-list 111 deny ip any any

But still when it is applied inbound to the dialer, none of the incomming services work (not FTP or Remote Desktop). Take off the ACL and it all works fine again.

It must be how I am specifying source and destination, but I cant understand how its going wrong.

Cheers.