Cisco Router Port Forwarding

[MulLa]

Hi all,

Went online and dug up some info on opening up ports for Exchange.

It suggested the following 2 lines which I did add
ip nat inside source static tcp 172.16.30.1 25 interface Dialer1 25
ip nat inside source static tcp 172.16.30.1 443 interface Dialer1 443

I guess those online docs did not assume you have access lists going so I had to add the following lines to make it work

interface Dialer1
ip access-group 140 in

access-list 140 permit tcp any any eq smtp
access-list 140 permit tcp any any eq 443

Note I have not included all configs to access lists etc to save space only what I think is relevant here, if you need more info just ask.

The funny thing is that when I used the following access lists instead it doesn?t work

access-list 140 permit tcp any 172.16.30.1 eq smtp
access-list 140 permit tcp any 172.16.30.1 eq 443

Obviously the Exchange server is at 172.16.30.1 and I'm wondering why doesn?t it work when access lists specifically restricts it to the correct LAN address?? Hm?


Thanks in advance!

 

[bill00009912]

It doesn't work because you are using the destination address after it is translated. Access lists are done before nat so you need to use the real outside address if you know what it is

See
http://www.cisco.com/en/US/tech/tk648/t...logies_tech_note09186a0080133ddd.shtml

 

[MulLa]

Ahh... Thanks for the informative link sure does explain a lot of things!