NAT on ADSL Connection

Question

I am having a ADSL connection with dynamic IP from my ISP, I am using a Cisco 837 router.
I need to access one of my servers from the internet. I am using a dyndns agent in my server so that I will know the updated IP address. I tried setting NAT on the dialer0 interface, but it did not work. I need to NAT 2 ports (port 22 and 122) to a LAN server: 192.168.5.11
Here is the original config file:
Please see attached.
I searched the web and I tried this:
config t
interface dialer0
ip access-group 104 in
exit
access-list 104 permit tcp any any eq 22
access-list 104 permit tcp any any eq 122
ip nat inside source static tcp 192.168.5.11 25 interface dialer0 22
ip nat inside source static tcp 192.168.5.11 25 interface dialer0 122
After I entered these command, I can no longer access the internet.
May I know where did I do wrong?
Can anyone assist me?
Thanks.

Answer 1

You should be using "inspection" on the internal and external interfaces.
Inspection will create dynamic holes in the firewall to facilitate traffic in the return path, and will simplify your interface ACLs.
The internal interface ACL should be configured to permit the specific protocols permitted (by security policy) for outbound communication. Applying inspection on the internal interface will provision the return path by opening dynamic holes in the outside interface ACL.
The same is done on the external interface. An ACL is created to permit connections from external hosts to your internal servers. Inspection is applied there to facilitate packets returning from your servers, by opening dynamic holes in the internal interface's ACL.
Inspection would be a better choice that using the established key word in ACLs.
e.g.: A simple inspection example:
ip inspect log drop-pkt
ip inspect audit-trail
ip inspect name our-insp tcp
ip inspect name our-insp udp
ip inspect name our-insp icmp
ip inspect name our-insp dns
ip inspect name our-insp ftp
ip inspect name our-insp pop3
interface Ethernet0
description ~5Mbps Exposed to Internet
ip inspect our-insp in
interface FastEthernet0
description Internal Network
ip inspect our-insp in
Note: Ideally you would migrate to Granular Protocol Inspection and avoid the generic UDP and TCP inspection, but that is up to you.
I've not looked at your NAT issues, just the lack of Internet connectivity following application of the limited ACL on the external interface.