I am configuring a Cisco 877.
My experience with these is limited and I am editing an existing configuration which may not be perfect.
The router is used for:
-ADSL Connectivity
-Internet Access for local LAN.
-Routing EMail (Port 25) Traffic to mail server
-Routing RDP Traffic to server.
-Software VPN access to the network
However, the Port 25 and RDP access was open - i.e. not locked down by source - simply being allowed by NAT rules.
To remedy this I have created an access list and applied it to the Dialer interface, which is defined as the external interface.
In order to maintain Internet access I have also applied the IOS (Reverse)Firewal to the VLAN Interface.
However, since applying this the Software VPN fails to work.
Removing the Access List from the Dialer allows the Password Prompt to be received on the client side, but the client hangs authenticating - removing the IOS Firewall from the VLAN Int then allows full functionality again.
So I need to know what I need to add to the IOS Firewall or Access list to allow this traffic?
Or is there something else I should add?
Below are the bits of the config I think are relevant.:
===================================
ip inspect name DEFAULT100 cuseeme
ip inspect name DEFAULT100 ftp
ip inspect name DEFAULT100 h323
ip inspect name DEFAULT100 netshow
ip inspect name DEFAULT100 rcmd
ip inspect name DEFAULT100 realaudio
ip inspect name DEFAULT100 rtsp
ip inspect name DEFAULT100 smtp
ip inspect name DEFAULT100 sqlnet
ip inspect name DEFAULT100 streamworks
ip inspect name DEFAULT100 tftp
ip inspect name DEFAULT100 tcp
ip inspect name DEFAULT100 udp
ip inspect name DEFAULT100 vdolive
ip inspect name DEFAULT100 icmp
no ip auth-proxy max-nodata-conns 3
no ip admission max-nodata-conns 3
no ip domain lookup
ip domain name rhs.ie
==================================
interface Vlan1
description $ETH-SW-LAUNCH$$INTF-INFO-HWIC 4ESW$
ip address 192.168.100.254 255.255.255.0
ip access-group 101 in
ip nat inside
ip inspect DEFAULT100 in
no ip redirects
no ip unreachables
no ip proxy-arp
ip virtual-reassembly
ip route-cache flow
ip tcp adjust-mss 1452
hold-queue 100 out
!
interface Dialer0
description $FW_OUTSIDE$
ip address negotiated
ip mtu 1492
ip nat outside
ip virtual-reassembly
encapsulation ppp
dialer pool 1
dialer-group 1
ip access-group 103 in
===================================
ip nat inside source list 110 interface Dialer0 overload
ip nat inside source static tcp 192.168.100.1 25 Y.Y.80.108 25 extendable
ip nat inside source static tcp 192.168.100.1 1723 Y.Y.80.108 1723 extendable
ip nat inside source static tcp 192.168.100.1 3389 Y.Y.80.108 3389 extendable
!
access-list 101 remark auto generated by SDM firewall configuration
access-list 101 remark SDM_ACL Category=1
access-list 101 deny ip host 255.255.255.255 any
access-list 101 deny ip 127.0.0.0 0.255.255.255 any
access-list 101 permit ip any any
access-list 103 remark Softech
access-list 103 permit tcp host x.x.x.x any log
access-list 103 permit tcp host x.x.x.x any log
access-list 103 permit tcp host x.x.x.x any eq 25 log
access-list 103 permit tcp host x.x.x.x any eq 25 log
access-list 103 permit tcp x.x.x.x 0.0.0.255 any eq 25 log
access-list 103 permit tcp x.x.x.x 0.0.0.192 any eq 25 log
access-list 110 remark NAT-list
access-list 110 deny ip 192.168.100.0 0.0.0.255 10.0.100.0 0.0.0.255
access-list 110 permit ip 192.168.100.0 0.0.0.255 any
==================================
ip nat inside source list 110 interface Dialer0 overload
ip nat inside source static tcp 192.168.100.1 25 Y.Y.80.108 25 extendable
ip nat inside source static tcp 192.168.100.1 1723 Y.Y.80.108 1723 extendable
ip nat inside source static tcp 192.168.100.1 3389 Y.Y.80.108 3389 extendable
==================================================
dialer-list 1 protocol ip permit
