RV042 Firewall & Port Forwarding

I am installing a RV042 on a client SBS network. In the configuration, I notice that there is a place for port forwarding where I guess I could open the ports for smtp, http, https, ...
But there are also access rules in the firewall section which seem to be the same except that you can schedule them.
Question is, do I need to configure both, or if only one of them, which one?
Thanks in advance for the advice.
Bob Showalter, Packer International

Bob,
You only need to configure port forwarding, unless you want to specify a source and destination that the packet is allowed or denied; then you would use both.
hope this helps,
Jasbryan

Similar Messages

RV042 vpn&port forwarding problems

Hello,
I spent a few days trying to configure the RV042 router but I messed up. I need this router for VPN access on my site and Port Forwarding to an internal web server. Apparently very simple task, isn't it?
So:
1. PPTP is working fine but I need more than 5 concurrent accesses.
2. Quickvpn does not work when the DHCP server is checked and I can't access any computer from my lan. I have a DHCP server in my LAN but when I'm conected through Quickvpn I never reach it. In the log file there are messages like:
Connection refused - Policy violation TCP 169.254.x.x->192.168.1.2 (DHCP server from my lan)
3. On Setup > Forwarding I added a Port Range Forwarding for HTTP port 80 to an internal IP address (192.168.1.x). I although added a firewall access rule to allow traffic to Port 80 from any source interface and any source IP to 192.168.1.x.
From the internal LAN, using the WAN IP of the router, the Port forwarding works but not form the outside, though in the log file of the router it appears to work:
Connection Accepted TCP 208.64.252.230:33027->192.168.1.x:80 on ixp1
What could I have done wrong?
The router is configured with a static address as a gateway and it has the latest firmware 1.3.12.19-tm. The access rules are the default ones and the one I added.
Any help would be much apreciated.
Thanks.

Can't answer as to why QVPN fails when you enable DHCP on the router, but concidering your requirements it seems to be a moot point. So, you have a DHCP server on your network which I will guess is also running your Web service. If this is a Windows server does your current configuration allow you to enable PPTP on it? If so, that would solve the five user limit. You will need to turn off the PPTP server on the router and then forward port 1723 TCP to your server and you are done. As for your http access, remove any rule that you have in reference to "allow" port 80 connectivity to your web server. Not sure why but this tends to confuse the poor little things. Once you have verified that port 80 is active on the server via the LAN (which you already have) then you are done. If you are still not successful with the connection to the server from the WAN you may want to default the router and start over (lame I know).
*** SORRY, just noticed that you stated that you added a "port range" forwarding rule. Remove that, and configure a UPnP rule for the same server instead. Do not know why they call it that, they just do. This is the same as configuring a single port forward they just call it something different. So just port forward 80 tcp to your server on 192.168.1.x and you are done.

RV042 Port Forwarding bypassing ACL

I have a RV042 with Port Forwarding configured for RDP. This Port Forwarding Rule is being applied before my ACL - so subnets that are not authorized through are being allowed in. Firmware version 4.0.0.07. Any help would be greatly appreciated.

Hi Eric, the default state table may be the problem.
Try to make an access rule something like-
Action Deny
Service All
Source interface WAN
Source IP any
Destination IP any
Save
Action Permit
Service RDP
Source interface WAN
Source IP -xx.xx.xx.xx
Destination IP - xx.xx.xx.xx
Save
-Tom
Please mark answered for helpful posts

Quantum Gateway Port Forwarding issues

This post can be removed.... the port forwarding worked once I set it up under "Advanced Settings -> Network Settings ->Port Forwarding" instead of "Firewall -> Port Forwarding"
Hello,
I am having an issue setting up port forwarding. I have made several attempts to make port forward TCP 8096, but it continues not to work. I had it working with no problems at my with my old router before we moved so I know it's not an issue with my computer firewall or antivirus and MediaBrowser is working fine on the local network. Is anyone else experiencing Port Forwarding issues? Also when will DMZ be enabled on this gateway?
Any help would be apprciated. I'm trying to setup MediaBrowser so I can schedule recordings when i'm not at home.
Thanks!
Armyb77
This post can be removed

See kayster contribution here.
SYNOLOGY DS214 - Remote access via BT Home Hub
There are some useful help pages here, for BT Broadband customers only, on my personal website.
BT Broadband customers - help with broadband, WiFi, networking, e-mail and phones.

RDP Port Forwarding non-functional

OK, so I'm having yet another issue with my RV220w. I thought this would be a wise buy, but I keep finding reasons to hate myself for buying this router.
Anyway, I need to forward port 3389, Windows Remote Desktop Protocol to one of my internal servers. I have defualt NAT, defualt firewall, etc. etc. I have seen documentation that says that Firewall -> Port Forwarding is non-functional, so I attempt to set up port forwarding via Firewall -> Access Rules. I did not see "RDP" or any other obvious acronym for Remote Desktop Protocol in the services list. So, I made a custom service, called RemoteDP, TCP protocol, port 3389 to 3389.
No, I cannot RDP to my server from WAN. What gives? This was easily achieved with a cheap NETGEAR router from 2005.
Very confused, and therefore disappointed.
SAM

Join the club. . . .I have the same issues with custom rules and have been trying to get it to work for over a month now. I can only stall for so long with this problem. I need to get some ports open for established services that also was not a problem with a residential Netgear router.

RV220W - Port Forwarding - Different Ports

Hey,
I have a RV220W with 1.0.3.5 Firmware installed.
I also have a few servers with services I need to expose to outside the network (RDP and some websites) where the external port is not the same as the LAN port. I could accomplish this with my previous router using port forwarding and it looks like I can do the same here on the RV220W but I can't quite get it to work successfully. I would be grateful for any help / directions.
Thanks.

So here is how Port Forwarding is set up on the RV220W with firmware 1.0.3.5
In my example I needed to setup my :6001 to forward to an internal address for remote desktop, 192.168.1.12:3389.
First, as detailed above by Robert, set up the custom service you want the public address to be listening for. In 1.0.3.5 I found this under Firewall > Advanced Settings > Custom Settings. Add a new service speficying the name, protocol, and ports. For my RDP connection It was "RDP", TCP, and the Start Port and End Port set as "6001", the port that was listening publicly.
Next go to Firewall > Port Forwarding and add a port forwarding record. And set the following values.
Action: Always Allow
Service:
Destination IP:
Forward From Port: Same as incoming port
Forward To Port: 3389
Hit save and that should be it. The problem I was running into is I was setting the "Forward From Port" as the port I wanted to have translated, so 6001. This is already specified with the custom service I created, so when setting it twice it wasnt working.

Port forwarding - some more clarity please

I have set up port forwarding in the past and never had the problems that I am currently experiencing with HH4 with two ip cams. It would be great if there were some simple rules to follow - and I do appreciate the efforts of people on this forum but I am still confused. Can anyone answer the following
1 - there is an option to set up Dynammic DNS at advanced/broadband/dynamic DNS. Can I setup two cameras (one using No-ip the other using an embeded foscam DN) using this option?
2 - Within the advanced/firewall/port forwarding section I can allocate a port. I have allocated 8090 for camera 1 and 8095 for camera 2. When I checked my ports both were "timed out" - what causes that.
3 - I read on one of the posts that the ports should be outside of the allocated DNS range - can anyone tell me what the HH4 allocated DNS range is and are any other port numbers to be avoided - I was using 1000 as a port and this seemed to have problems
4 - Does a port have to be allocated for the camera set up on question 1 above (I am assuming yes but I am having so many problems I need to check every step!).
5 - I want to access the cameras from several different phones, tablets laptops etc, also my son will want access and possibly others - so if more than one person tries to access the same IP cam will one fail or is the port forwarding port shared? Or do I need to add another setting somewhere to allow multiple access to the same port.
6 - I would like to have a permanent display on my Google TV - If I just use the local IP address of the camera will that block all other users including those on the home network and external.
It would be great to just get the cameras working without them stopping every few days.

I should start this off with a couple of quick caveats: I've never had to use DynDNS, so can't advise with regard to that and have never used a HH4, but have used and helped to set up on a Business Hub 3 which is very similar firmware. With that in mind:
2/ The timing out on your checks normally, in my experience, means that the firewall is passing the information, but the device isn't responding in time. If you try a port check using www.subnetonline.com, you normally get on of 3 responses, open, error 110 which is the connection timing out and 111 which is connection refused. 111 is normally the firewall bouncing the scan. You could try doing a port check, then go to the event log on the router and see if it has a filter for firewall. If so, you could take a look on there to see if it is showing the packet being passed. If it is, then normally that would indicate that it is the device that needs looking at rather than the router.
3/ The devices, for a fixed internal address, should be outside the DHCP range, the range of addresses that the router hands out dynamically. The range on the HH 4 is, I believe, 192.168.1.64-.1.253. As a result, fixing an address to a device, you would have the range .1.1-.1.63 available. If you do set the address on the device, please make sure that the gateway address is 192.168.1.254. In my experience, a lot of cameras seem to have .1.1 as a default for that, which would make a port check fail.
4/ Yes, you would need ports forwarding for both devices.
5/ Again, I go back to my caveats, but I have had multiple people, on multiple sites and devices, all accessing a device that I have set port forwarding up for. This has included cameras as well as storage devices, for example, and it has worked fine with no additional settings.
6/I can't speak specifically to the to Google TV, but having something permanently accessing on an internal address, whcih as you are aware doesn;t use port forwarding, should have absolutely no effect on something accessing from externally.
Apologies I couldn't comment on the DynDNS or specifically to the HH4, but someone with a little more experience of both of those should be able to add to my mutterings.
Hope this helped a little.
A

Rv220w port forwarding dvr

I have a dvr that uses RasPlus app to connect to dvr remotely. The netgear router allowed me to portforward to both tcp and udp to the dvrs lan address. I'm not finding this option in rv220w. Thanks! I just need to allow rasplus app to access dvr at address 192.168.1.150 on port 8016.

Hello jeff reynolds,
First I would update to the latest firmware on the RV220W. The latest is 1.0.6.6:
Here is the link: https://software.cisco.com/download/release.html?mdfid=283118607&softwareid=282487380&release=1.0.6.6&relind=AVAILABLE&rellifecycle=&reltype=latest
After that you will go under Firewall > Port forwarding. You will create your rule there. However you many need to make a custom service.
To create a custom service: Firewall > Advanced Settings > Custom Services page, click Add
Put in the necessary information then create your port forwarding rule.
Hope this help,
Regards,
Michael D.

RV042 Port forwarding stops working when Firewall is enabled

Hey all,
I have a RV042 router on a single WAN and an internal LAN. I have configured port forwarding as follows:
HTTP[TCP/80~80]->10.0.0.6
HTTPS[TCP/443~443]->10.0.0.6
IMAP[TCP/143~143]->10.0.0.5
IMAP SSL[TCP/993~993]->10.0.0.5
SMTP SSL[TCP/587~587]->10.0.0.5
Everything works just fine when I have the firewall DISABLED. However, when I enable it the behaviour is erratic. 1 out of 10 attempts to connect to ANY port forwarded works. Almost all attempts time out.
Notice that this happens even if using only the default firewall rules (which should be bypassed by the port forwarding as I read in other posts).
My second try was to create firewall rules manually, overriding the default ones. I tried adding rules from source WAN1 (where my connection is) to ANY and to SINGLE IP's on every port. Nothing seems to work.
I don't know what I'm doing wrong, this is really bugging me. I had to turn the firewall off so we can access our servers from outside the office. This shouldn't have to be done.
Do you know anything I could try?
Best regards,
Theo
EDIT:
Just found out that my firewall is getting LOTS and LOTS of Blocked - SYN Flood entries. I think this is why we are having trouble with the firewall. Could this be the problem? I have no idea where all these SYN packets are coming from since they appear with spoofed IPs or come from different bots all over.

Hi Theo, if you want to over ride the default state table, you need to first make firewall rules to block all access then make your permission rules.
Such an example would be-
Action Deny
Service All
Source interface WAN
Source IP any
Destination IP any
Save
Action Permit
Service RDP
Source interface WAN
Source IP -xx.xx.xx.xx
Destination IP - xx.xx.xx.xx
Save
As for your concern about the syn flood, it can be a likely cause of your problems. Does the logging facility of the router give any indications?
-Tom
Please mark answered for helpful posts

Port Forwarding with Port Translation RV042, RV016, RV082

This is a feature request for the Linksys RV series Routers. Currently, it appears that the Cisco/Linksys RV042, RV082, and RV016 only support port forwarding and 1-to-1 Nat. One item that I find very helpful with customers is port forwarding with port translation. I am requesting that this feature be included with a future firmware relase for these RV series routers.
Here is an example of the request.
Take an incoming service request on a TCP or UDP destination port and forward it to an internal IP on a different TCP or UDP port. For example, customer A wants to allow different machines on the internal network to receive Windows RDP connections inbound. To make PC maintenance identical between the internal machines, the customer does not want to change the listening port for RDP on the individual PC workstations through the Windows Registry. The customer also does not want to dedicate separate IP's to each machine in a 1-to-1 NAT setup. The only option is to have remote connections to each of these PC's to use a different destination port. So, for example, PC one could be reached on TCP port 5151, PC two on TCP port 5152, and PC three on port 5153. This requres a firewall that is able to translate each of these connection requests to a different internal IP on the default RDP port (TCP 3389). So, the following setup is required:
Port Forwarding with Port Translation:
Router External IP on TCP port 5151 ---> forwarded to PC One's internal IP on TCP 3389
Router External IP on TCP port 5152 ---> forwarded to PC Two's internal IP on TCP 3389
Router External IP on TCP port 5153 ---> forwarded to PC Three's internal IP on TCP 3389
There are several comparable "small business" class router competitors to the RV042, RV082, and RV016 that will perform this port forwarding with port translation process without incident. Unfortunately, these Cisco/Linksys small business routers will not accomplish this task currently.
Please implement this feature in a future firmware release.
Thanks!

Excellent. I see this now. None of our customers actually use the UPNP feature, so we never realized that Port Forwarding with Port Translation features existed on this page along with the ability to enable or disable UPNP.
Perhaps, in the future, this functionality could be moved to and incorporated into the port forwarding page which seems to be a more logical location.
In either case I'm very happy to know that this feature is available on the RV's.
Thanks for your assistance.

Cisco 5520 ASA Port Forward to Endian Firewall VPN Question

Hello,
We have had a VPN operational on our Endian Firewall which uses OpenVPN server on port number 1194. We recently purchased a Cisco 5520 ASA to put in front of our Endian Firewall and I am still hoping to use our current Endian Firewall VPN server. So I am thinking the easiest way to make this happen is to port forward all vpn traffic through the ASA to our Endian Firewall to access the VPN. Anyhow, I am just hoping someone with higher knowledge can let me know if this is the best course of action or if there is another easier or more efficient way of doing this?
Thanks for your comments in advance I am new to cisco technology,
Joe

Wrong forum, post in "Secuirity - Firewalling". You can move your posting with the Actions panel on the right.

Port Forwarding/Router Firewall HELP

I'm trying to use my iSight built in cam with "aMSN" and they give me error messages when I configure. It says I have firewall/port issues to free up or something. Here's what help says to do:
"To do this, open your router web-based configuration (check router manual for details on this). Once you have the web-based configuration open, browse for a setting called "port forwarding" or "port range forwarding" or something similar to that. (This might be found under the advanced features for your router).
Now that you have the port forwarding page open, you will want to set the port forwarding range so that aMSN will be able to accept and send the webcam stream.
Here's an example of how you will set up your port forwarding:
Application: aMSN
Start: 6890
End: 6900
Protocol: Both(TCP & UDP)
IP: xxx.xxx.x.xxx
Enabled: X (Yes/True)
Note: xxx.xxx.x.xxx is the IP of your machine that you are trying to send / receive webcam
If you have a web server open on your port 80, you can try to disable it too, sometimes it helps. "
All I'm asking is how do I get to the port forwarding page to do what they have displayed above? I've tried Apple support topics on the subject and all were irrelevent or only dealt with iChat.
Any ideas? Thank you!

Are you using an Airport? If not, what type of router do you have connected? Each manufactor is different, but should provide the information in their manuals.

Port Forwarding/Firewall Query

I've got the BT 2Wire.com gateway router, and I'm mystified by the setup screen, when I want to add more than one firewall pinhole for a pc on my network, it complains that that pinhole is already assigned to another pc.
But I don't understand that a pinhole in the firewall isn't the same as 'port-forwarding' is it?
I might have multiple pcs behind the router all of which need the same hole in the firewall.

There may be quite a few diffences, they could mean port forwarding.
The BT Business forum is at http://business.forums.bt.com
Its possible someone there may be able to help.
There s a general guide to port forwarding on my website.
There are some useful help pages here, for BT Broadband customers only, on my personal website.
BT Broadband customers - help with broadband, WiFi, networking, e-mail and phones.

Port Forwarding Cisco firewall

Hi,
In Cisco Firewall 2900 seires
trying to use port forwarding
but not communication please help me.
Reg
Manoj.

: Saved
: Written by enable_15 at 23:01:39.772 UTC Thu Jan 30 2014
name 10.10.70.X.40 FinalPdf
name 201.256.x.x Youfinalip
interface Ethernet0/0
nameif YOUB
security-level 0
ip address 201.256.x.x.254.82 255.255.255.248
interface Ethernet0/2
nameif inside
security-level 100
ip address 10.10.70.X.1 255.255.255.0
interface Management0/0
nameif management
security-level 100
ip address 192.168.1.1 255.255.255.0
management-only
ftp mode passive
object-group protocol TCPUDP
protocol-object udp
protocol-object tcp
object-group service ftp tcp
port-object eq ftp
port-object eq ftp-data
port-object eq 14147
object-group service any tcp-udp
port-object range 1 65535
object-group service DM_INLINE_TCP_1 tcp
group-object ftp
port-object eq ftp-data
access-list EXEMPT extended permit ip 10.10.70.X.0 255.255.255.0 192.168.10.0 255.255.255.0
access-list EXEMPT extended permit ip 10.10.70.X.0 255.255.255.0 10.70.0.0 255.255.0.0
access-list EXEMPT extended permit ip 10.10.70.X.0 255.255.255.0 192.168.0.0 255.255.0.0
access-list inside_access_in extended deny object-group TCPUDP any any eq domain
access-list inside_access_in extended permit ip any any
access-list YOUB_mpc extended permit ip any any
access-list YOUB_access_in extended permit object-group TCPUDP any interface YOUB inactive
access-list YOUB_access_in extended permit tcp any host Youfinalip object-group ftp
pager lines 24
logging enable
logging emblem
logging asdm-buffer-size 512
logging buffered debugging
logging trap debugging
logging history debugging
logging asdm debugging
logging device-id hostname
logging debug-trace
logging ftp-bufferwrap
logging ftp-server 10.10.70.X.251 firwall/ firwall firwall
logging class auth trap emergencies asdm emergencies
mtu YOUB 1500
mtu SIFY 1500
mtu inside 1500
mtu WAN 1500
mtu management 1500
ip verify reverse-path interface YOUB
ip verify reverse-path interface inside
icmp unreachable rate-limit 1 burst-size 1
asdm image disk0:/asdm-645.bin
asdm location Testpdf 255.255.255.255 inside
asdm history enable
arp timeout 14400
global (YOUB) 1 interface
global (SIFY) 1 interface
nat (inside) 0 access-list EXEMPT
nat (inside) 1 10.10.70.X.0 255.255.255.0 dns
static (inside,YOUB) tcp Youfinalip ftp Testpdf ftp netmask 255.255.255.255
access-group YOUB_access_in in interface YOUB
access-group inside_access_in in interface inside
route YOUB 0.0.0.0 0.0.0.0 201.256.x.x.254.81 1 track 1
route inside 0.0.0.0 0.0.0.0 10.10.70.X.1 10
route WAN 10.60.0.0 255.255.255.0 10.70.100.38 1
route WAN 192.168.8.0 255.255.255.0 10.70.100.38 1
timeout xlate 3:00:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
timeout tcp-proxy-reassembly 0:01:00
timeout floating-conn 0:00:00
dynamic-access-policy-record DfltAccessPolicy
aaa authentication http console LOCAL
aaa authentication ssh console LOCAL
http server enable
http 192.168.1.0 255.255.255.0 management
http 0.0.0.0 0.0.0.0 inside
no snmp-server location
no snmp-server contact
snmp-server enable traps snmp authentication linkup linkdown coldstart
sla monitor 100
type echo protocol ipIcmpEcho 4.2.2.2 interface YOUB
num-packets 3
frequency 10
sla monitor schedule 100 life forever start-time now
crypto ipsec security-association lifetime seconds 28800
crypto ipsec security-association lifetime kilobytes 4608000
track 1 rtr 100 reachability
telnet timeout 5
ssh scopy enable
ssh 10.10.70.X.0 255.255.255.0 inside
ssh timeout 5
console timeout 0
threat-detection basic-threat
threat-detection statistics access-list
no threat-detection statistics tcp-intercept
webvpn
username cisco password 3USUcOPFUiMCO4Jk encrypted
class-map YOUB-class
match access-list YOUB_mpc
class-map inspection_default
match default-inspection-traffic
policy-map type inspect dns preset_dns_map
parameters
message-length maximum client auto
message-length maximum 512
policy-map global_policy
description ftp
class inspection_default
inspect dns preset_dns_map
inspect h323 h225
inspect h323 ras
inspect rsh
inspect rtsp
inspect esmtp
inspect sqlnet
inspect skinny
inspect sunrpc
inspect xdmcp
inspect sip
inspect netbios
inspect tftp
inspect ip-options
inspect ftp
class class-default
ips inline fail-open
policy-map YOUB-policy
class YOUB-class
ips inline fail-open sensor vs0
service-policy global_policy global
service-policy YOUB-policy interface YOUB
smtp-server 10.10.70.X.18
prompt hostname context
no call-home reporting anonymous
call-home
profile CiscoTAC-1
no active
destination address http https://tools.cisco.com/its/service/oddce/services/DDCEService
destination address email [email protected]
destination transport-method http
subscribe-to-alert-group diagnostic
subscribe-to-alert-group environment
subscribe-to-alert-group inventory periodic monthly
subscribe-to-alert-group configuration periodic monthly
subscribe-to-alert-group telemetry periodic daily
Cryptochecksum:aace81256bc60bc50469f80cb0c4641a
: end

Port forwarding Cisco RV042 / RV042G

Hi,
we use three Cisco RV042 small Business Routers.
The problem:
We want to forward HTTPS on Wan-side to an other port than 443 on Lan-side.
For example: Wan 217.44.55.66 port 443 to 192.168.0.5 port 5001
There is only this option in RV042 : Forwarding -> Service HTTPS [TCP/443~443] to "IP-Adress" (also Port 443)
but we need something like this:
Forwarding -> Service HTTPS [TCP/443~443] to 192.168.0.5:5001
How can I configure it ?
Greetings from Germany
Goetz Hartwig, ITUC GmbH

Hi Ituconsult1
My name is Mehdi from Cisco Technical Support, yes with RV042 we can translate the port
Please follow this steps:
1. Please remove the rule of the port forwarding
2. Go to Setup under UPnP , service management and you will see external port and internal port so please configure external port to 443 and internal to 5001 and click add, please do not enable UPnP
3. on the same page please choose the service you created and put the internal IP of the server server
Please rate the post or mark it as answered to help other Cisco customers
Greeting
Regards
Mehdi

RV042 Firewall & Port Forwarding

Similar Messages

Maybe you are looking for