HH4 port forwarding
Hello,
I had infinity option2 installed yesterday with the HH4
I tried to set up port forwarding for SSH to my linux box but no matter what I do I cannot get a connection.
I have done port scans from http://ping.eu/port-chk/ to port 22 but it says it is closed.
I have turned off UPnP extended security as said in a few forums.
Any ideas would be greatly appreciated.
Thanks
Not sure whether its the same as other home hubs, but this may help.
Port forwarding problems
There are some useful help pages here, for BT Broadband customers only, on my personal website.
BT Broadband customers - help with broadband, WiFi, networking, e-mail and phones.
Similar Messages
-
I am missing something here! Maybe it is my advanced years (85)
I have 2 IP cameras that I managed to control via Virgin Super Hub but since switching to BT the Home Hub 4 has me confused.
Can someone please give me a step by step example of how to port forward a camera (say) ‘007dwsr’ http:/192.168.1.xx:88.
I am O.K. accessing the hub up to ‘Port Forwarding’ but then what I enter into what box after that I cannot figure out.
I need this to keep an eye on my aged wife.And this page.
CCTV and IP cameras - port forwarding
There are some useful help pages here, for BT Broadband customers only, on my personal website.
BT Broadband customers - help with broadband, WiFi, networking, e-mail and phones. -
Port forwarding to two devices with HH4
Having set up my IP camera with HH4 successfully, I've now got another one and would like to set it up as well. I gave it a unique, static IP address which my router can see fine. When I try to set up port forwarding, I get a message saying:
"The game or application you’ve selected conflicts with an application (IP Cam 1) you’ve already assigned to another device. Please remove the other application or select the same device."
I am not being given the option to select the same device.
I'm now wondering if port forwarding to two identical devices actually works in principle with HH4? Has anyone else done this?
Solved!
Go to Solution.klara wrote:
Having set up my IP camera with HH4 successfully, I've now got another one and would like to set it up as well. I gave it a unique, static IP address which my router can see fine. When I try to set up port forwarding, I get a message saying:
"The game or application you’ve selected conflicts with an application (IP Cam 1) you’ve already assigned to another device. Please remove the other application or select the same device."
I am not being given the option to select the same device.
I'm now wondering if port forwarding to two identical devices actually works in principle with HH4? Has anyone else done this?
If in the Home Hub 4 A you go to
Advanced Settings
Firewall
Port Fowarding
Manage Games and Applications
You get the following statement:
"Each game or application can be assigned to only one device on your home network"
I would think that the only way round your problem is to have each Camera running a different application or the same application with a different name.
Does the remote browser app need to know the application name or just the device name ?
If you think about how Port Forwarding needs to function you need a way whereby the remote user needs to be able to tell the Hub what Camera to talk to. -
Port Forwarding To Two Macs with Port 22 limitations
This is another port forwarding/port 22 issue and I've look around and not seen an answer to my specific problem. I work for a business that has an in-house ad system that runs on a Mac Mini. I have been accessing that Mac Mini remotely because we set up port forwarding through the Linksys rounter that is at the business using port 22. This is the only port that works for this connection to the mini and the software.
We are now adding a second Mac Mini to send the ads to a different set of monitors. I can't set up port forward to the new mini on the same port so I don't know how to connect to this mini remotely. Is there a way to get into the first mini through port 22 and then somehow communite to the second one through the first? Is there another way to do port forwarding...or have the linksys router switch from one mini to the other when a request comes in? There will only be one remote computer trying to reach either Mac Mini so there will never be simultaneous traffic coming in. Any help would be appreciated!
The linksys router is critical to the business becasue a host of other devices are forwarded though it as well.
Thank you.klara wrote:
Having set up my IP camera with HH4 successfully, I've now got another one and would like to set it up as well. I gave it a unique, static IP address which my router can see fine. When I try to set up port forwarding, I get a message saying:
"The game or application you’ve selected conflicts with an application (IP Cam 1) you’ve already assigned to another device. Please remove the other application or select the same device."
I am not being given the option to select the same device.
I'm now wondering if port forwarding to two identical devices actually works in principle with HH4? Has anyone else done this?
If in the Home Hub 4 A you go to
Advanced Settings
Firewall
Port Fowarding
Manage Games and Applications
You get the following statement:
"Each game or application can be assigned to only one device on your home network"
I would think that the only way round your problem is to have each Camera running a different application or the same application with a different name.
Does the remote browser app need to know the application name or just the device name ?
If you think about how Port Forwarding needs to function you need a way whereby the remote user needs to be able to tell the Hub what Camera to talk to. -
Bit Torrent port forwarding issue and DNS resoluti...
Good morning comunity!
Something odd has happened and I was hoping for some further guidance as I'm not sure what my next steps are.
Background
I have uTorrent running on a a machine that accesses a private RSS feed of torrents I am watching. The client sees a new file posting and automaticlly downloads the .torrent file then proceeds to download the main file itself.
When I had BT installed back on 23 Decemeber I set up port forwarding to this machine, using a static IP, and there were no connection issues.
What has happened
The previous evening as I was going to bed I checked the machine and the active torrents and all my files were sitting at 0 connections for connected seeds & peers. Meaning that uTorrent wasn't able to see anyone to conenct to.
My Troubleshooting
After seeing the above I began checking my connections and set up on the router as well as the machine. uTorrent has within its preferences a port checking utility for its assinged port and that was showing no open connection. I then logged in to my HH4 and verifed my port forwarding rules: nothing had changed there.
I removed and re-added the rules, turned off UPNP as well as turned it on with no success. And during the process of adding the rule back into the system I recieved an error stating that the port was already assigned even though at that moment there were no active assignments. So I changed port numbers and the issue went away.
I then went to chack the private torrent site and the page would not display. Then went to Down For Everyone Or Just Me to check the site as well and it was reported as being up. I loaded my VPN connection to bypass BT's network and I was able to visit the site. Logged back out and did a trace and the trace reported to route to the site. Changed my DNS to Google's DNS setting and was able to access the site.
Where I am now
My torrent machine is now running via the VPN but it's not the best connection in the world as changing the DNS there did not resolve the torrent connection issue.
Does anyone, especially you folkd familar with BT and their practices, have reccomendations as to what to try next or what the issue may be?A lot of torrent sites are starting to be blocked. Its possible the site in question is being blocked by BT(They have no choice in this as its being forced onto them by a court order same for most of the other big ISPs). If its being blocked you would still be able to access via a VPN so long as thats not being blocked too. In terms of what you can do about it not much other than keep using the VPN.
-
BT HomeHub 4 - Cannot configure Port Forwarding
so I want to open port forwarding on my HH4 to set up Vodafone Sure Signal which stopped working when infinity installed. the instructions at
http://bt.custhelp.com/app/answers/detail/a_id/43715
bear no relation to what I get on Home Hub Manager please advise....Here is an example of the settings for an IP camera connected to a home hub 4.
http://forumhelp.dyndns.info/hardware/cctv/foscam/foscam.html
It should give you some extra guidance.
There are some useful help pages here, for BT Broadband customers only, on my personal website.
BT Broadband customers - help with broadband, WiFi, networking, e-mail and phones. -
OK, first post here. Hello.
I've searched the forums and checked the FAQ's for an answer, no joy.
I simply need to open port 9000 on my HH4 to allow out of home access to my new Buffalo NAS.
The port fowarding FAQ - here - does not work:
http://bt.custhelp.com/app/answers/detail/a_id/43715
If you follow the instructions to setup a customer application you can enter the port you need, however once saved, your custome app does not then appear in the Application drop down list so it is impossible to associate it with a device (the NAS in my case)
Has anyone manged to get port forwarding on a custom app working for a HH4?
As an aside FTP does not seem to appear as an optional protocol to open - is this not supported?
Solved!
Go to Solution.Use the IP address not the device name.
This page should help.
Port forwarding problems
There are some CCTV example on this page.
Help with setting up routers, repeaters, Smart TVs, printers, CCTV, NAS, VOIP
There are some useful help pages here, for BT Broadband customers only, on my personal website.
BT Broadband customers - help with broadband, WiFi, networking, e-mail and phones. -
Port forwarding - some more clarity please
I have set up port forwarding in the past and never had the problems that I am currently experiencing with HH4 with two ip cams. It would be great if there were some simple rules to follow - and I do appreciate the efforts of people on this forum but I am still confused. Can anyone answer the following
1 - there is an option to set up Dynammic DNS at advanced/broadband/dynamic DNS. Can I setup two cameras (one using No-ip the other using an embeded foscam DN) using this option?
2 - Within the advanced/firewall/port forwarding section I can allocate a port. I have allocated 8090 for camera 1 and 8095 for camera 2. When I checked my ports both were "timed out" - what causes that.
3 - I read on one of the posts that the ports should be outside of the allocated DNS range - can anyone tell me what the HH4 allocated DNS range is and are any other port numbers to be avoided - I was using 1000 as a port and this seemed to have problems
4 - Does a port have to be allocated for the camera set up on question 1 above (I am assuming yes but I am having so many problems I need to check every step!).
5 - I want to access the cameras from several different phones, tablets laptops etc, also my son will want access and possibly others - so if more than one person tries to access the same IP cam will one fail or is the port forwarding port shared? Or do I need to add another setting somewhere to allow multiple access to the same port.
6 - I would like to have a permanent display on my Google TV - If I just use the local IP address of the camera will that block all other users including those on the home network and external.
It would be great to just get the cameras working without them stopping every few days.I should start this off with a couple of quick caveats: I've never had to use DynDNS, so can't advise with regard to that and have never used a HH4, but have used and helped to set up on a Business Hub 3 which is very similar firmware. With that in mind:
2/ The timing out on your checks normally, in my experience, means that the firewall is passing the information, but the device isn't responding in time. If you try a port check using www.subnetonline.com, you normally get on of 3 responses, open, error 110 which is the connection timing out and 111 which is connection refused. 111 is normally the firewall bouncing the scan. You could try doing a port check, then go to the event log on the router and see if it has a filter for firewall. If so, you could take a look on there to see if it is showing the packet being passed. If it is, then normally that would indicate that it is the device that needs looking at rather than the router.
3/ The devices, for a fixed internal address, should be outside the DHCP range, the range of addresses that the router hands out dynamically. The range on the HH 4 is, I believe, 192.168.1.64-.1.253. As a result, fixing an address to a device, you would have the range .1.1-.1.63 available. If you do set the address on the device, please make sure that the gateway address is 192.168.1.254. In my experience, a lot of cameras seem to have .1.1 as a default for that, which would make a port check fail.
4/ Yes, you would need ports forwarding for both devices.
5/ Again, I go back to my caveats, but I have had multiple people, on multiple sites and devices, all accessing a device that I have set port forwarding up for. This has included cameras as well as storage devices, for example, and it has worked fine with no additional settings.
6/I can't speak specifically to the to Google TV, but having something permanently accessing on an internal address, whcih as you are aware doesn;t use port forwarding, should have absolutely no effect on something accessing from externally.
Apologies I couldn't comment on the DynDNS or specifically to the HH4, but someone with a little more experience of both of those should be able to add to my mutterings.
Hope this helped a little.
A -
Port Forwarding for RDP 3389 is not working
Hi,
I am having trouble getting rdp (port 3389) to forward to my server (10.20.30.20). I have made sure it is not an issue with the servers firewall, its just the cisco. I highlighted in red to what i thought I need in my config to get this to work. I have removed the last 2 octets of the public IP info for security .Here is the configuration below:
TAMSATR1#show run
Building configuration...
Current configuration : 11082 bytes
version 15.2
no service pad
service timestamps debug datetime msec localtime show-timezone
service timestamps log datetime msec localtime show-timezone
service password-encryption
hostname TAMSATR1
boot-start-marker
boot system flash:/c880data-universalk9-mz.152-1.T.bin
boot-end-marker
logging count
logging buffered 16384
enable secret
aaa new-model
aaa authentication login default local
aaa authentication login ipsec-vpn local
aaa authentication login ciscocp_vpn_xauth_ml_1 local
aaa authorization console
aaa authorization exec default local
aaa authorization network groupauthor local
aaa session-id common
memory-size iomem 10
clock timezone CST -6 0
clock summer-time CDT recurring
crypto pki token default removal timeout 0
crypto pki trustpoint TP-self-signed-1879941380
enrollment selfsigned
subject-name cn=IOS-Self-Signed-Certificate-1879941380
revocation-check none
rsakeypair TP-self-signed-1879941380
crypto pki certificate chain TP-self-signed-1879941380
certificate self-signed 01
3082024B 308201B4 A0030201 02020101 300D0609 2A864886 F70D0101 04050030
31312F30 2D060355 04031326 494F532D 53656C66 2D536967 6E65642D 43657274
69666963 6174652D 31383739 39343133 3830301E 170D3131 30393136 31393035
32305A17 0D323030 31303130 30303030 305A3031 312F302D 06035504 03132649
4F532D53 656C662D 5369676E 65642D43 65727469 66696361 74652D31 38373939
34313338 3030819F 300D0609 2A864886 F70D0101 01050003 818D0030 81890281
8100BD7E 754A0A89 33AFD729 7035E8E1 C29A6806 04A31923 5AE2D53E 9181F76C
ED17D130 FC9B5767 6FD1F58B 87B3A96D FA74E919 8A87376A FF38A712 BD88DB31
88042B9C CCA8F3A6 39DC2448 CD749FC7 08805AF6 D3CDFFCB 1FE8B9A5 5466B2A4
E5DFA69E 636B83E4 3A2C02F9 D806A277 E6379EB8 76186B69 EA94D657 70E25B03
542D0203 010001A3 73307130 0F060355 1D130101 FF040530 030101FF 301E0603
ip dhcp excluded-address 10.20.30.1 10.20.30.99
ip dhcp excluded-address 10.20.30.201 10.20.30.254
ip dhcp excluded-address 10.20.30.250
ip dhcp pool tamDHCPpool
import all
network 10.20.30.0 255.255.255.0
default-router 10.20.30.1
domain-name domain.com
dns-server 10.20.30.20 8.8.8.8
ip domain name domain.com
ip name-server 10.20.30.20
ip cef
no ipv6 cef
license udi pid CISCO881W-GN-A-K9 sn
crypto vpn anyconnect flash:/webvpn/anyconnect-dart-win-2.5.3054-k9.pkg sequence 1
ip tftp source-interface Vlan1
class-map type inspect match-all CCP_SSLVPN
match access-group name CCP_IP
policy-map type inspect ccp-sslvpn-pol
class type inspect CCP_SSLVPN
pass
zone security sslvpn-zone
crypto isakmp policy 10
encr aes 256
authentication pre-share
group 2
crypto isakmp policy 20
encr aes 192
authentication pre-share
group 2
crypto isakmp key password
crypto isakmp client configuration group ipsec-ra
key password
dns 10.20.30.20
domain tamgmt.com
pool sat-ipsec-vpn-pool
netmask 255.255.255.0
crypto ipsec transform-set ipsec-ra esp-aes esp-sha-hmac
crypto ipsec transform-set TSET esp-aes esp-sha-hmac
crypto ipsec profile VTI
set security-association replay window-size 512
set transform-set TSET
crypto dynamic-map dynmap 10
set transform-set ipsec-ra
reverse-route
crypto map clientmap client authentication list ipsec-vpn
crypto map clientmap isakmp authorization list groupauthor
crypto map clientmap client configuration address respond
crypto map clientmap 10 ipsec-isakmp dynamic dynmap
interface Loopback0
ip address 10.20.250.1 255.255.255.252
ip nat inside
ip virtual-reassembly in
interface Tunnel0
description To AUS
ip address 192.168.10.1 255.255.255.252
load-interval 30
tunnel source
tunnel mode ipsec ipv4
tunnel destination
tunnel protection ipsec profile VTI
interface FastEthernet0
no ip address
interface FastEthernet1
no ip address
interface FastEthernet2
no ip address
interface FastEthernet3
no ip address
interface FastEthernet4
ip address 1.2.3.4
ip access-group INTERNET_IN in
ip access-group INTERNET_OUT out
ip nat outside
ip virtual-reassembly in
no ip route-cache cef
ip route-cache policy
ip policy route-map IPSEC-RA-ROUTE-MAP
duplex auto
speed auto
crypto map clientmap
interface Virtual-Template1
ip unnumbered Vlan1
zone-member security sslvpn-zone
interface wlan-ap0
description Service module interface to manage the embedded AP
ip unnumbered Vlan1
arp timeout 0
interface Wlan-GigabitEthernet0
description Internal switch interface connecting to the embedded AP
switchport mode trunk
no ip address
interface Vlan1
description $ETH-SW-LAUNCH$$INTF-INFO-HWIC 4ESW$
ip address 10.20.30.1 255.255.255.0
ip nat inside
ip virtual-reassembly in
ip tcp adjust-mss 1452
ip local pool sat-ipsec-vpn-pool 10.20.30.209 10.20.30.239
ip default-gateway 71.41.20.129
ip forward-protocol nd
ip http server
ip http access-class 23
ip http authentication local
ip http secure-server
ip http timeout-policy idle 60 life 86400 requests 10000
ip dns server
ip nat inside source list ACL-POLICY-NAT interface FastEthernet4 overload
ip nat inside source static tcp 10.20.30.20 3389 interface FastEthernet4 3389
ip nat inside source static 10.20.30.20 (public ip)
ip route 0.0.0.0 0.0.0.0 public ip
ip route 10.20.40.0 255.255.255.0 192.168.10.2 name AUS_LAN
ip access-list extended ACL-POLICY-NAT
deny ip 10.0.0.0 0.255.255.255 10.20.30.208 0.0.0.15
deny ip 172.16.0.0 0.15.255.255 10.20.30.208 0.0.0.15
deny ip 192.168.0.0 0.0.255.255 10.20.30.208 0.0.0.15
permit ip 10.20.30.0 0.0.0.255 any
permit ip 10.20.31.208 0.0.0.15 any
ip access-list extended CCP_IP
remark CCP_ACL Category=128
permit ip any any
ip access-list extended INTERNET_IN
permit icmp any any echo
permit icmp any any echo-reply
permit icmp any any unreachable
permit icmp any any time-exceeded
permit esp host 24.153. host 66.196
permit udp host 24.153 host 71.41.eq isakmp
permit tcp host 70.123. host 71.41 eq 22
permit tcp host 72.177. host 71.41 eq 22
permit tcp host 70.123. host 71.41. eq 22
permit tcp any host 71..134 eq 443
permit tcp host 70.123. host 71.41 eq 443
permit tcp host 72.177. host 71.41. eq 443
permit udp host 198.82. host 71.41 eq ntp
permit udp any host 71.41. eq isakmp
permit udp any host 71.41eq non500-isakmp
permit tcp host 192.223. host 71.41. eq 4022
permit tcp host 155.199. host 71.41 eq 4022
permit tcp host 155.199. host 71.41. eq 4022
permit udp host 192.223. host 71.41. eq 4022
permit udp host 155.199. host 71.41. eq 4022
permit udp host 155.199. host 71.41. eq 4022
permit tcp any host 10.20.30.20 eq 3389
evaluate INTERNET_REFLECTED
deny ip any any
ip access-list extended INTERNET_OUT
permit ip any any reflect INTERNET_REFLECTED timeout 300
ip access-list extended IPSEC-RA-ROUTE-MAP
deny ip 10.20.30.208 0.0.0.15 10.0.0.0 0.255.255.255
deny ip 10.20.30.224 0.0.0.15 10.0.0.0 0.255.255.255
deny ip 10.20.30.208 0.0.0.15 172.16.0.0 0.15.255.255
deny ip 10.20.30.224 0.0.0.15 172.16.0.0 0.15.255.255
deny ip 10.20.30.208 0.0.0.15 192.168.0.0 0.0.255.255
deny ip 10.20.30.224 0.0.0.15 192.168.0.0 0.0.255.255
permit ip 10.20.30.208 0.0.0.15 any
deny ip any any
access-list 23 permit 70.123.
access-list 23 permit 10.20.30.0 0.0.0.255
access-list 24 permit 72.177.
no cdp run
route-map IPSEC-RA-ROUTE-MAP permit 10
match ip address IPSEC-RA-ROUTE-MAP
set ip next-hop 10.20.250.2
banner motd ^C
UNAUTHORIZED ACCESS TO THIS NETWORK DEVICE IS PROHIBITED.
You must have explicit permission to access or configure this device. All activities performed on this device are logged and violations of this policy may result in disciplinary and/or legal action.
^C
line con 0
logging synchronous
line aux 0
line 2
no activation-character
no exec
transport preferred none
transport input all
line vty 0
access-class 23 in
privilege level 15
logging synchronous
transport input telnet ssh
line vty 1 4
access-class 23 in
exec-timeout 5 0
privilege level 15
logging synchronous
transport input telnet ssh
scheduler max-task-time 5000
ntp server 198.82.1.201
webvpn gateway gateway_1
ip address 71.41. port 443
http-redirect port 80
ssl encryption rc4-md5
ssl trustpoint TP-self-signed-1879941380
inservice
webvpn context TAM-SSL-VPN
title "title"
logo file titleist_logo.jpg
secondary-color white
title-color #CCCC66
text-color black
login-message "RESTRICTED ACCESS"
policy group policy_1
functions svc-enabled
svc address-pool "sat-ipsec-vpn-pool"
svc default-domain "domain.com"
svc keep-client-installed
svc split dns "domain.com"
svc split include 10.0.0.0 255.0.0.0
svc split include 192.168.0.0 255.255.0.0
svc split include 172.16.0.0 255.240.0.0
svc dns-server primary 10.20.30.20
svc dns-server secondary 66.196.216.10
default-group-policy policy_1
aaa authentication list ciscocp_vpn_xauth_ml_1
gateway gateway_1
ssl authenticate verify all
inservice
endHi,
I didnt see anything marked with red in the above? (Atleast when I was reading)
I have not really had to deal with Routers at all since we all access control and NAT with firewalls.
But to me it seems you have allowed the traffic to the actual IP address of the internal server rather than the public IP NAT IP address which in this case seems to be configured to use your FastEthernet4 interfaces public IP address.
There also seems to be a Static NAT configured for the same internal host so I am wondering why the Static PAT (Port Forward) is used?
- Jouni -
ASA 5505 how to create a port forwarding rule
ASA 5505 IOS ver 9.2.3
I need to create a firewall rule that will allow internal services to be accessed externally, but using port forwarding. For example I'd like to enable access to our NAS via ftp external on port 1545 and then have the ASA forward the request to the NAS internally on port 21.
I tried these commands but they didn't work:
object network NAS
host 192.168.2.8
nat (inside,outside) static interface service tcp 21 1545
access-list NASFTP-in permit tcp any object NAS eq 1545
conf t
int vlan 2
access-group NASFTP-in permit tcp any object NAS eq 1545
I really appreciate the help everyone.try this, it worked for me, here is an example of adding a webserver with a ip of 10.10.50.60 and naming it with a object named www-server and forwarding port 80 , the way it works is you need to do three things, u need to "nat it" "foward it" and allow it in "acl"
object network obj-10.10.50.60-1
host 10.10.50.60
nat (inside,outside) static interface service tcp 80 80
object network INSIDE
nat (inside,outside) dynamic interface
object network WWW-SERVER
nat (inside,outside) static interface service tcp 80 80
access-list Outside_access_in extended permit tcp any object WWW-SERVER eq 80
access-group Outside_access_in in interface Outside -
Cisco 5520 ASA Port Forward to Endian Firewall VPN Question
Hello,
We have had a VPN operational on our Endian Firewall which uses OpenVPN server on port number 1194. We recently purchased a Cisco 5520 ASA to put in front of our Endian Firewall and I am still hoping to use our current Endian Firewall VPN server. So I am thinking the easiest way to make this happen is to port forward all vpn traffic through the ASA to our Endian Firewall to access the VPN. Anyhow, I am just hoping someone with higher knowledge can let me know if this is the best course of action or if there is another easier or more efficient way of doing this?
Thanks for your comments in advance I am new to cisco technology,
JoeWrong forum, post in "Secuirity - Firewalling". You can move your posting with the Actions panel on the right.
-
Hello,
i have a problem with a single port forward with 9.2 ASA (5505). Here is the related config.:
access-list outside_access_in extended permit icmp any any
access-list outside_access_in extended permit tcp any host 10.168.50.5 eq www log
access-list DMZ_in extended permit ip any any
nat (DMZ,outside) source dynamic obj_any interface
nat (DMZ,outside) source static any any destination static VPN_Pool VPN_Pool no-proxy-arp route-lookup
nat (outside,DMZ) source dynamic any interface destination static Public_Server Public_Server service HTTP HTTP
object network Public_Server
nat (DMZ,outside) static interface service tcp www www
access-group outside_access_in in interface outside
access-group DMZ_access_in in interface DMZ
When i try to access the server, the console said ACL drops. The packet tracer said that it dropped in the implicit deny rule. Can you help me what can be the problem?
Thank You!Yes, of course, i can ping, and also from VPN. And also the web service works from VPN, local. Tha packet-tracer said the same, the implicit deny catch it.:
packet-tracer input outside tcp 8.8.8.8 http OUTIFIP http det
Phase: 1
Type: ACCESS-LIST
Subtype:
Result: ALLOW
Config:
Implicit Rule
Additional Information:
Forward Flow based lookup yields rule:
in id=0xad2a1718, priority=1, domain=permit, deny=false
hits=89868, user_data=0x0, cs_id=0x0, l3_type=0x8
src mac=0000.0000.0000, mask=0000.0000.0000
dst mac=0000.0000.0000, mask=0100.0000.0000
input_ifc=outside, output_ifc=any
Phase: 2
Type: ROUTE-LOOKUP
Subtype: Resolve Egress Interface
Result: ALLOW
Config:
Additional Information:
in OUTIFIP 255.255.255.255 identity
Phase: 3
Type: NAT
Subtype: per-session
Result: ALLOW
Config:
Additional Information:
Forward Flow based lookup yields rule:
in id=0xad071248, priority=1, domain=nat-per-session, deny=true
hits=1199, user_data=0x0, cs_id=0x0, reverse, use_real_addr, flags=0x0, protocol=6
src ip/id=0.0.0.0, mask=0.0.0.0, port=0, tag=0
dst ip/id=0.0.0.0, mask=0.0.0.0, port=0, tag=0, dscp=0x0
input_ifc=any, output_ifc=any
Phase: 4
Type: ACCESS-LIST
Subtype:
Result: DROP
Config:
Implicit Rule
Additional Information:
Forward Flow based lookup yields rule:
in id=0xad2a23b8, priority=0, domain=permit, deny=true
hits=883, user_data=0x9, cs_id=0x0, use_real_addr, flags=0x1000, protocol=0
src ip/id=0.0.0.0, mask=0.0.0.0, port=0, tag=0
dst ip/id=0.0.0.0, mask=0.0.0.0, port=0, tag=0, dscp=0x0
input_ifc=outside, output_ifc=any
Result:
input-interface: outside
input-status: up
input-line-status: up
output-interface: NP Identity Ifc
output-status: up
output-line-status: up
Action: drop
Drop-reason: (acl-drop) Flow is denied by configured rule -
HELP!! asa 5505 8.4(5) problem with port forwarding-smtp
Hi I am having a big problem with port forwarding on my asa. I am trying to forward smtp through the asa to my mail server.
my mail server ip is 10.0.0.2 and my outside interface is 80.80.80.80 , the ASA is setup with pppoe (I get internet access no problem and that seems fine)
When I run a trace i get "(ACL-Drop) - flow is deied by configured rule"
below is my config file , any help would be appreciated
Result of the command: "show running-config"
: Saved
ASA Version 8.4(5)
hostname ciscoasa
domain-name domain.local
enable password mXa5sNUu4rCZ.t5y encrypted
passwd 2KFQnbNIdI.2KYOU encrypted
names
interface Ethernet0/0
switchport access vlan 2
interface Ethernet0/1
interface Ethernet0/2
interface Ethernet0/3
interface Ethernet0/4
interface Ethernet0/5
interface Ethernet0/6
interface Ethernet0/7
interface Vlan1
nameif inside
security-level 100
ip address 10.0.0.1 255.255.255.0
interface Vlan2
nameif outside
security-level 0
pppoe client vpdn group ISPDsl
ip address 80.80.80.80 255.255.255.255 pppoe setroute
ftp mode passive
dns server-group DefaultDNS
domain-name domain.local
same-security-traffic permit intra-interface
object network obj_any
subnet 0.0.0.0 0.0.0.0
object network Server_SMTP
host 10.0.0.2
access-list outside_access_in extended permit tcp any object server_SMTP eq smtp
pager lines 24
logging asdm informational
mtu inside 1500
mtu outside 1500
icmp unreachable rate-limit 1 burst-size 1
no asdm history enable
arp timeout 14400
no arp permit-nonconnected
object network obj_any
nat (inside,outside) dynamic interface
object network server_SMTP
nat (inside,outside) static interface service tcp smtp smtp
nat (inside,outside) after-auto source dynamic any interface
access-group outside_access_in in interface outside
timeout xlate 3:00:00
timeout pat-xlate 0:00:30
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
timeout tcp-proxy-reassembly 0:01:00
timeout floating-conn 0:00:00
dynamic-access-policy-record DfltAccessPolicy
user-identity default-domain LOCAL
http server enable
http 10.0.0.0 255.255.255.0 inside
no snmp-server location
no snmp-server contact
snmp-server enable traps snmp authentication linkup linkdown coldstart warmstart
telnet timeout 5
ssh timeout 5
ssh key-exchange group dh-group1-sha1
console timeout 0
vpdn group ISP request dialout pppoe
vpdn group ISP localname [email protected]
vpdn group ISP ppp authentication chap
vpdn username [email protected] password *****
dhcpd auto_config outside
threat-detection basic-threat
threat-detection statistics access-list
no threat-detection statistics tcp-intercept
webvpn
class-map inspection_default
match default-inspection-traffic
policy-map type inspect dns preset_dns_map
parameters
message-length maximum client auto
message-length maximum 512
policy-map global_policy
class inspection_default
inspect dns preset_dns_map
inspect ftp
inspect h323 h225
inspect h323 ras
inspect rsh
inspect rtsp
inspect sqlnet
inspect skinny
inspect sunrpc
inspect xdmcp
inspect sip
inspect netbios
inspect tftp
inspect ip-options
service-policy global_policy global
prompt hostname context
no call-home reporting anonymous
Cryptochecksum:c5570d7ddffd46c528a76e515e65f366
: endHi Jennifer
I have removed that nat line as suggested but still no joy.
here is my current config
Result of the command: "show running-config"
: Saved
ASA Version 8.4(5)
hostname ciscoasa
domain-name domain.local
enable password mXa5sNUu4rCZ.t5y encrypted
passwd 2KFQnbNIdI.2KYOU encrypted
names
interface Ethernet0/0
switchport access vlan 2
interface Ethernet0/1
interface Ethernet0/2
interface Ethernet0/3
interface Ethernet0/4
interface Ethernet0/5
interface Ethernet0/6
interface Ethernet0/7
interface Vlan1
nameif inside
security-level 100
ip address 10.0.0.1 255.255.255.0
interface Vlan2
nameif outside
security-level 0
pppoe client vpdn group ISP
ip address 80.80.80.80 255.255.255.255 pppoe setroute
ftp mode passive
dns server-group DefaultDNS
domain-name domain.local
same-security-traffic permit intra-interface
object network obj_any
subnet 0.0.0.0 0.0.0.0
object network Server_Mail
host 10.0.0.2
access-list outside_access_in extended permit tcp any object Server_Mail eq smtp
pager lines 24
logging asdm informational
mtu inside 1500
mtu outside 1500
icmp unreachable rate-limit 1 burst-size 1
no asdm history enable
arp timeout 14400
no arp permit-nonconnected
object network obj_any
nat (inside,outside) dynamic interface
object network Server_Mail
nat (inside,outside) static interface service tcp smtp smtp
access-group outside_access_in in interface outside
timeout xlate 3:00:00
timeout pat-xlate 0:00:30
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
timeout tcp-proxy-reassembly 0:01:00
timeout floating-conn 0:00:00
dynamic-access-policy-record DfltAccessPolicy
user-identity default-domain LOCAL
http server enable
http 10.0.0.0 255.255.255.0 inside
no snmp-server location
no snmp-server contact
snmp-server enable traps snmp authentication linkup linkdown coldstart warmstart
telnet timeout 5
ssh timeout 5
ssh key-exchange group dh-group1-sha1
console timeout 0
vpdn group ISP request dialout pppoe
vpdn group ISP localname [email protected]
vpdn group ISP ppp authentication chap
vpdn username [email protected] password *****
dhcpd auto_config outside
threat-detection basic-threat
threat-detection statistics access-list
no threat-detection statistics tcp-intercept
webvpn
class-map inspection_default
match default-inspection-traffic
policy-map type inspect dns preset_dns_map
parameters
message-length maximum client auto
message-length maximum 512
policy-map global_policy
class inspection_default
inspect dns preset_dns_map
inspect ftp
inspect h323 h225
inspect h323 ras
inspect rsh
inspect rtsp
inspect esmtp
inspect sqlnet
inspect skinny
inspect sunrpc
inspect xdmcp
inspect sip
inspect netbios
inspect tftp
inspect ip-options
service-policy global_policy global
prompt hostname context
no call-home reporting anonymous
Cryptochecksum:f3bd954d1f9499595aab4f9da8c15795
: end
also here is the packet trace
and my acl
Thanks -
I am trying to setup port forwarding
I am trying to setup port forwarding for a mfi 5510l hotspot. I have made the changes on the hotspot but the hotspot doen't respond when tested. Can anyone help?
If you examine the About section of the Jetpack’s web style user interface, you should find that it has a reserved IP4 IP address. That means your Jetpack doesn’t connect directly to the public internet, your Jetpack is connected to Verizon’s private network. Your port forwarding has no affect on Verizon’s private network.
The standard recommendation is:
Purchase a public facing static IP address from Verizon for a one time fee of $500.
Use a VPN to go around the issue.
Use another ISP that provides a static IP address. -
Trying to Port Forward Airport Extreme 802.11ac using Airpot Utility 6.3.2
Hello kind experts. I am finally getting around to replacing my old BEFSR81 Cisco Router with an old Time Capsule attached with the Airport Extreme 802.11ac. The BEFSR81 also had 8 ports, so I have 8 hardwired locations throughout the house. I have a couple of IP cameras for which it was easy to port forward on the Cisco (just click on the port range forwarding tab, type the start/end ranges (which are identical) and the assigned IP address). Everything has been working well for years. Here's what I wish to do with the new setup: Cable Modem -> Airport Extreme -> Dumb gigaport switch with the hardwires connected to it.
When I go to Airport Utility (6.3.2) -> Network Tab -> Port Settings -> "+", the following comes up:
Firewall Entry Type (Defaulted to IPv4 Port Mapping)
Description (5 pull down choices)
Public UDP Ports : _________
Public TCP Ports: __________
Private IP Address (I take it that is where I enter the IP address for each camera, e.g. 192.168.1.xxx)?
Private UDP Ports: __________
Private TCP Ports: __________
I am obviously not a technophile, especially when it comes to networking, but was able to create my old setup.
Any advice on whether or not my configuration is appropriate and what exactly I need to put in the port fields would be greatly appreciated!
Thanks in advance!To successfully access an IP camera on the local network from the Internet, the following basics need to be taken care of:
Install the camera(s) and verify that you can access them from the local network.
Configure port mapping/forwarding on your router. Typically, IP cameras require at least two ports: 1) A web port for administering the camera; Usually TCP port 80, and 2) A streaming port to broadcast the camera video feed; Usually UDP port 9000. Note: You should check with your camera's documentation for the exact ports required.
If the camera is attached to a computer, you will need to configure the computer's firewall to open the same ports as in step 2 above.
Verify that your modem is in bridge mode, i.e., if the modem provides NAT & DHCP services, turn them off.
Test your network. Use CheckIP to determine your router's current WAN-side (public) IP address. Then, from a remote location (not from a computer on the local network), use the DynDNS Open Port Tool to verify that the required ports are open. Success is an "Open" response from the Tool.
Check out the following AirPort User tip for configuring port mapping on an AirPort base station.
Maybe you are looking for
-
I have been in touch with the bank support and they had me change the proxy setting and this helped once and then the problem returned. I have gone paperless and I need to access these sites to run my business. I work on a Toshiba laptop using Vista.
-
I received a notice to download a newer version of itunes. After starting the process of downloading I got an error message which then suggested I try to download itunes again. When I did this it showed the file was already in my system and stopped
-
Java.lang.NullPointerException in webstarterappII application.log
Hi, all, When I try WebStarter Application II (WSA II), I find many java.lang.NullPointerException in application.log, like this: 03/10/20 06:41:42 webstarterappII: Version: 1.0 LOGGING: DocServlet:service(), request to show document 03/10/20 06:41:4
-
How to get Current Page(region) Name/ID in OA 11i
We need to get the name or id of the current page, and based on the pagename, we retrieve configuration to launch specific web service. pageContext.getPageLayoutBean().getPageFunctionName() is no sufficient. Since one page function sometimes contain
-
Date time string from UME-SPML interface
Hi, I am using the UME-SPML interface to manage users in SAP UME and using AS ABAP user management as the user store for UME. I have noticed a problem in the date time string returned in the SPML search response when I search for a user. When you sea