Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- Cisco Community
- :
- About onyxwolf_x
Stats
Member since
04-02-2010
11
Posts
0
Helpful
0
Solutions
04-16-2010
05:01 PM
It turned out to be a server issue (the openvpn service needed reset). The reason I assumed it was router side is because it happened when I swapped my linksys out for my Cisco router. Damn coincidences! everything is working great now! ACLs were all fine and I confirmed that my router does not support CBAC so will live with reflexive. Its funny that they edit out the expletive that is a homophone to dam (like the beavers build).
... View more
04-13-2010
03:14 PM
from what I understand, CBAC is only available with the security IOS. Or firewall addition on my router, an 1841, but I don't have nor will not be able to get it so reflexive rules will have to work for now. I am almost off work so I can test that and let you know
... View more
04-13-2010
10:58 AM
I haven't. I'll try that, I really need to set up ssh so I can do it remotely. That scares me to give access to my router like that. Is there a way that you can set the router's ssh to check a client's keys? The evaluate command is telling it to run that traffic through the temporary access lists created by a connection that triggers the outbound access-list. For example when you make a outboundfilters rule permit tcp any any reflect tcptraffic makes a temporary list called tcptraffic when any tcp connections go through it. The inboundfilters rule evaluate tcptraffic it basically adds that tcptraffic list to the inboundfilters ACL. That connection is removed from the tcptraffic list as soon as a fin goes through it. UDP and ICMP works a little differently (the reflect list entries flip ports and do some weird stuff) but since there is no fin packet, it waits 300 seconds (default I changed it to 120) then deletes that entry from the lists. I'll try removing the list access-group, but really it should see that permit before anything else right?
... View more
04-13-2010
09:46 AM
Below are my complete configs. As you can probably see, I'm attempting to forward ports UDP 1194 and TCP 443 to my server (old desktop converted to openvpn server). But as far as I can tell the ports aren't being forwarded (IE openvpn is running on that server, all configs look good, but seeing no attempted connections, no logs from attempts to connect). Can anyone see any problems with my config that would cause this? service password-encryption hostname myrouter enable secret XXXXX aaa new-model aaa session-id common ip cef ! ip dhcp excluded-address ip dhcp excluded-address 192.168.0.1 192.168.0.60 ip dhcp pool HOMENET import all network 192.168.0.0 255.255.255.0 default-router 192.168.0.1 dns-server 192.168.0.4 68.87.85.102 ! ip domain name rtp.private.private ip ssh time-out 60 username onyxwolf password XXXX ! interface FastEthernet0/0 description Internal_Network ip address 192.168.0.1 255.255.255.0 ip nat inside ip virtual-reassembly no ip route-cache cef no ip route-cache duplex auto speed auto no cdp enable no shutdown ! interface FastEthernet0/1 description Web_Side ip address dhcp ip access-group inboundfilters in ip access-group outboundfilters out ip nat outside ip virtual-reassembly no ip route-cache cef no ip route-cache duplex auto speed auto no cdp enable no shutdown ! ip route 0.0.0.0 0.0.0.0 FastEthernet0/1 ! no ip http server no ip http secure-server ! ip nat inside source list 102 interface FastEthernet0/1 overload ip nat inside source static tcp 192.168.0.5 443 interface FastEthernet0/1 443 ip nat inside source static udp 192.168.0.5 1194 interface FastEthernet0/1 1194 ! ip access-list extended inboundfilters permit udp any any eq bootps permit udp any any eq bootpc permit tcp any any eq 443 permit udp any any eq 1194 deny ip 192.168.0.0 0.0.255.255 any deny ip 172.16.0.0 0.15.255.255 any deny ip 10.0.0.0 0.255.255.255 any deny ip 192.0.2.0 0.0.0.255 any deny ip 127.0.0.0 0.255.255.255 any deny ip 255.0.0.0 0.255.255.255 any deny ip host 0.0.0.0 any evaluate udptraffic evaluate tcptraffic evaluate icmptraffic ! ip access-list extended outboundfilters permit udp any any eq bootps permit udp any any eq bootpc permit udp any any reflect udptraffic permit tcp any any reflect tcptraffic permit icmp any any reflect icmptraffic ! access-list 102 permit ip 192.168.0.0 0.0.0.255 any no cdp run line vty 0 4 transport input ssh
... View more
Labels:
Created by
onyxwolf_x
in Other Network Architecture Subjects
in Other Network Architecture Subjects
04-09-2010
08:59 AM
04-09-2010
08:59 AM
If I apply 103 to my line vty then I'll have to add my private network as well so I'll just want to add permit tcp "work's public IP" any eq ssh to my inboundfilters access-list, then not put the access-group 103 on the external interface, and add the line permit tcp 192.168.0.0 0.0.0.255 any eq ssh to ACL 103 (I'll have to make it extended of course).
... View more
Created by
onyxwolf_x
in Other Network Architecture Subjects
in Other Network Architecture Subjects
04-09-2010
08:51 AM
04-09-2010
08:51 AM
I've got everything else working (including ssh from my internal network) so I'm only posting configs directly related to the issues I'm wanting to resolve (IE trying to keep it short, sweet and to the point)... So my NAT rules will need to be as follows, are they correct (I also want 443 to that as well)? ip nat inside source list 102 interface FastEthernet0/1 overload ip nat inside source static tcp 192.168.0.5 443 interface FastEthernet0/1 443 ip nat inside source static udp 192.168.0.5 1194 interface FastEthernet0/1 1194 And then my access list entries will need to be as follows, correct? ip access-list extended inboundfilters permit tcp any any eq 443 permit udp any any eq 1194 access-list 102 permit ip 192.168.0.0 0.0.0.255 any access-list 103 permit tcp "work's public IP" any eq ssh Finally, I would apply 103 to line vty, I'm assuming it would be a access-group like so: (Do I need to apply the same access-group in on the external interface?) interface FastEthernet0/1 description Web-Facing ip access-group inboundfilters in ip access-group 103 in ip nat outside Line vty 0 4 ip access-group 103 in
... View more
Created by
onyxwolf_x
in Other Network Architecture Subjects
in Other Network Architecture Subjects
04-08-2010
10:05 AM
04-08-2010
10:05 AM
Sorry its taken so long to get back with you, but I want deny traffic with the same address as a source (spoofed traffic) and I want to allow ssh to it (this only temporary, until I can get my openVPN server working correctly. Which brings me to another question-- if I put the ip nat inside static commands on (forwarding the ports for openVPN) and permit access for those ports to my server (ie-- permit tcp any host 192.168.0.5 eq 1194), will it permit it or not? I ask this because my vpn client will obviously be targeting the external address, so without an access-list to permit that to the interface does the nat rule combined with the ACL permit allow it through (and I really don't want to put any as the destination). Or is that what you are telling me halijenn ?
... View more
04-08-2010
09:54 AM
Wow that sucks! No work around to this? I want to block spoofed traffic with the same address as my external interface as well as allow ssh (over a specific port) to that interface only. Its weird that ACL are the only things you can't define by interface vs. ip address. I guess it is what it is!
... View more
Created by
onyxwolf_x
in Other Network Architecture Subjects
in Other Network Architecture Subjects
04-02-2010
07:38 PM
04-02-2010
07:38 PM
How would you do that?
... View more
04-02-2010
07:30 PM
I have an 1841 router that gets it's internet-facing interface's address by my ISP's DHCP server. How can I use that address in an ACL, in a way that it will stay effective when it gets a new leased address?
... View more
Labels:
Created by
onyxwolf_x
in Other Network Architecture Subjects
in Other Network Architecture Subjects
04-02-2010
01:57 PM
04-02-2010
01:57 PM
I have a router that is connected to a cable ISP. My external interface receives its address from my ISP via DHCP (Interface FastEthernet 0/0 ip address DHCP). My question-- is there a way to make an ACL that uses that address? Meaning that the ACL changes when that address does?
... View more
Labels:
04-16-2010
It turned out to be a server issue (the openvpn service needed reset).
The reason I assumed it was r...
04-13-2010
from what I understand, CBAC is only available with the security IOS. Or
firewall addition on my rou...
04-13-2010
I haven't. I'll try that, I really need to set up ssh so I can do it
remotely. That scares me to giv...
04-13-2010
Below are my complete configs. As you can probably see, I'm attempting
to forward ports UDP 1194 and...
Created by
onyxwolf_x
in Other Network Architecture Subjects
04-09-2010
04-09-2010
If I apply 103 to my line vty then I'll have to add my private network
as well so I'll just want to ...
Created by
onyxwolf_x
in Other Network Architecture Subjects
04-09-2010
04-09-2010
I've got everything else working (including ssh from my internal
network) so I'm only posting config...
Created by
onyxwolf_x
in Other Network Architecture Subjects
04-08-2010
04-08-2010
Sorry its taken so long to get back with you, but I want deny traffic
with the same address as a sou...
04-08-2010
Wow that sucks! No work around to this? I want to block spoofed traffic
with the same address as my ...
Created by
onyxwolf_x
in Other Network Architecture Subjects
04-02-2010
04-02-2010
How would you do that?
04-02-2010
I have an 1841 router that gets it's internet-facing interface's address
by my ISP's DHCP server. Ho...
Created by
onyxwolf_x
in Other Network Architecture Subjects
04-02-2010
04-02-2010
I have a router that is connected to a cable ISP. My external interface
receives its address from my...
Public Statistics
| Date Registered | 04-02-2010 01:48 PM |
| Date Last Visited | 08-18-2017 03:53 AM |
| Total Messages Posted | 11 |
