Static NAT Translation for RDP port

[julijan.klancnik]

Hello there,

I can not make Static NAT to work in situation: I have 5 servers on my LAN and I would like to create static NAT translations for RDP Access from Outside.

This is my code:

ip nat inside source static tcp 192.168.2.200 3389 interface Dialer2 3389
ip nat inside source static tcp 192.168.2.23 3389 Interface Dialer2 3390
ip nat inside source static tcp 192.168.2.24 3389 Interface Dialer2 3391
ip nat inside source static tcp 192.168.2.21 3389 Interface Dialer2 3392
ip nat inside source static tcp 192.168.2.22 3389 Interface Dialer2 3393

ip nat inside source route-map RMAP interface Dialer2 overload

RDP Works on ports 3389, 3390 and 3391, but it doesn't on 3392 and 3393. If I change translation like this:

ip nat inside source static tcp 192.168.2.21 3389 Interface Dialer2 3390         it's working.

I have Cisco 1812 router, Version 12.4(15)T6; Is there some kind of limitation in port numbers?

Thank you, J

[Philip D'Ath]

There should be no such limitation.

Is there also an access-list allowing this traffic in?  Are you sure you are allowing tcp/3392 and tcp/3393 in?

[julijan.klancnik]

Philip thank you for your response.

I Shouldn't say that but I don't have any ACL on my outside interface.

I'am using this ACLs:

ACL for VTY Access:

access-list 5 permit "my public ip" 0.0.0.255
access-list 5 permit "customer's lan ip's" 0.0.0.255
access-list 5 permit "my private ips" 0.0.255.255

ACL for first S2S VPN (Customer to Customer remote location 1)

access-list 101 permit ip 192.168.2.0 0.0.0.255 192.168.4.0 0.0.0.255

ACL for first S2S VPN (Customer to Customer remote location 2)

access-list 103 permit ip 192.168.2.0 0.0.0.255 192.168.3.0 0.0.0.255

ACL for first S2S VPN (my company to Customer)

access-list 104 permit ip 192.168.2.0 0.0.0.255 "my private ip's - subnet 1" 0.0.255.255
access-list 104 permit ip 192.168.2.0 0.0.0.255 "my private ip's - subnet 2"  0.0.255.255

No nat ACL (for s2s vpn).

access-list 102 deny   ip 192.168.2.0 0.0.0.255 192.168.4.0 0.0.0.255 (Customer to Customer Remote 1)
access-list 102 deny   ip 192.168.2.0 0.0.0.255 192.168.3.0 0.0.0.255 (Customer to Customer remote 2)
access-list 102 deny   ip any "my private ip's - subnet 1" 0.0.255.255 (from my company subnet 1)
access-list 102 deny   ip any "my private ip's - subnet 2" 10.194.0.0 0.0.255.255 (from my company subnet 2)
access-list 102 permit ip 192.168.2.0 0.0.0.255 any

"not sure what this line do!?"

dialer-list 1 protocol ip permit

I've also found this:

ip http access-class 23

And on my Vlan 1 interface I've got ACL IN for stopping Access to FaceBook servers:

 deny   ip 192.168.2.0 0.0.0.255 74.119.76.0 0.0.3.255
 deny   ip 192.168.2.0 0.0.0.255 103.4.96.0 0.0.3.255
 deny   ip 192.168.2.0 0.0.0.255 204.15.20.0 0.0.3.255
 permit ip 192.168.2.0 0.0.0.255 any

J

[Philip D'Ath]

I can't see anything wrong sorry.  It looks correct to me.

[David Castro F.]

Hello J,

I was looking into it and it looks fine, for the working hosts (192.168.2.200, 192.168.2.23, 192.168.2.24) can you test those with the 3392 and 3393 ports?, also make sure to check the netstat status of the ports on the server for those 3392 and 3393 ports, configuration wise, it all looks good. Clear the IP NAT translations and then use another ports such as: 3387 and 3388. (Make sure the Route MAP is not bypassing the ports mentioned, just in case).

Please proceed to rate and mark as correct the helpful post!

David Castro,