Route traffic from a Dynamic WAN address on Pix 501

I am trying to allow access through a Cisco PIX 501 firewall. I have the
WAN port connected to a cable modem that is assigned a dynamic IP address.
I am aware that the WAN IP number will change. I am using the No-IP service
and software to keep me informed when the IP number changes.



I need to allow WAN traffic from a specific public IP address
(xxx.xxx.xxx.xxx) to redirect pcAnywhere (port 5631 & 5632) traffic to a
private IP address: 10.21.55.10, subnet mask: 255.255.255.0 behind the
firewall.



I also need to allow WAN traffic from a second specific public IP address:
(yyy.yyy.yyy.yyy) to redirect Terminal Service (Port 3389) and Compaq RIB II
(Ports 23, 80 & 443) traffic to a private IP address: 10.21.55.5 subnet
mask: 255.255.255.0 behind the firewall.



Here is the running-config

PIX Version 6.2(2)

nameif ethernet0 outside security0

nameif ethernet1 inside security100

enable password cBLalUer5EqAPcp3 encrypted

passwd cBLalUer5EqAPcp3 encrypted

hostname tgs-sd1

domain-name tgs.com

fixup protocol ftp 21

fixup protocol http 80

fixup protocol h323 h225 1720

fixup protocol h323 ras 1718-1719

fixup protocol ils 389

fixup protocol rsh 514

fixup protocol rtsp 554

fixup protocol smtp 25

fixup protocol sqlnet 1521

fixup protocol sip 5060

fixup protocol skinny 2000

names

pager lines 24

interface ethernet0 10baset

interface ethernet1 10full

mtu outside 1500

mtu inside 1500

ip address outside dhcp setroute

ip address inside 10.21.55.1 255.255.255.0

ip audit info action alarm

ip audit attack action alarm

pdm location 10.21.55.0 255.255.255.0 inside

pdm location 10.21.55.0 255.255.255.255 inside

pdm logging informational 100

pdm history enable

arp timeout 14400

global (outside) 1 interface

nat (inside) 1 0.0.0.0 0.0.0.0 0 0

timeout xlate 0:05:00

timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 rpc 0:10:00 h323
0:05:00 sip 0:30:00 sip_media 0:02:00

timeout uauth 0:05:00 absolute

aaa-server TACACS+ protocol tacacs+

aaa-server RADIUS protocol radius

aaa-server LOCAL protocol local

http server enable

http 10.21.55.0 255.255.255.0 inside

no snmp-server location

no snmp-server contact

snmp-server community t1pt0p

no snmp-server enable traps

floodguard enable

no sysopt route dnat

telnet 10.21.55.0 255.255.255.0 inside

telnet timeout 5

ssh timeout 5

dhcpd address 10.21.55.33-10.21.55.64 inside

dhcpd dns 63.240.76.4 204.127.198.4

dhcpd lease 3600

dhcpd ping_timeout 750

terminal width 80

Cryptochecksum:cf2727c57c100279d753d7f3e4cc7332

: end


I was looking at other post and they all seem to have a static IP number for
the WAN port. I need to be able to redirect any incoming traffic based on
the interface not the IP Number assigned to the interface. I hope this
makes sense. Any help will be appreciated.





Warren

 

:I am trying to allow access through a Cisco PIX 501 firewall. I have the
:WAN port connected to a cable modem that is assigned a dynamic IP address.

:I need to allow WAN traffic from a specific public IP address
xxx.xxx.xxx.xxx) to redirect pcAnywhere (port 5631 & 5632) traffic to a
rivate IP address: 10.21.55.10, subnet mask: 255.255.255.0 behind the
:firewall.

:I also need to allow WAN traffic from a second specific public IP address:
yyy.yyy.yyy.yyy) to redirect Terminal Service (Port 3389) and Compaq RIB II
Ports 23, 80 & 443) traffic to a private IP address: 10.21.55.5 subnet
:mask: 255.255.255.0 behind the firewall.

:I was looking at other post and they all seem to have a static IP number for
:the WAN port. I need to be able to redirect any incoming traffic based on
:the interface not the IP Number assigned to the interface. I hope this
:makes sense.

static (inside, outside) tcp interface 5631 10.21.55.10 5631 netmask 255.255.255.255 0 0
static (inside, outside) udp interface 5632 10.21.55.10 5632 netmask 255.255.255.255 0 0
static (inside, outside) tcp interface 3389 10.21.55.5 3389 netmask 255.255.255.255 0 0
static (inside, outside) tcp interface 80 10.21.55.5 80 netmask 255.255.255.255 0 0
static (inside, outside) tcp interface 443 10.21.55.5 443 netmask 255.255.255.255 0 0

However, you can't do tcp port 23. The PIX reserves tcp 23 and a port
in the 1700 range for communicating with the PIX itself, and will not
allow you to use interface port forwarding for port 23. In order to use
tcp port 23, you must have a second IP address. If, though, you can
configure the outside software so that it accesses a different port
(say, 15023), then you could use

static (inside, outside) tcp interface 15023 10.21.55.5 23 netmask 255.255.255.255 0 0

without changing your inside system.

 

Do I need to create access-lists for the ports to allow it through the
firewall and specify what IP address I will allow for the source of the IP
traffice? I assume I will use the private (10.21.55.x) to specify the
destination since I have a dynamic WAN address.

I have used dynamic DNS with a sonicWALL with no problems. Do yse see
any problems with the Pix?

Thanks for your help.

Warren

 

: Do I need to create access-lists for the ports to allow it through the
:firewall and specify what IP address I will allow for the source of the IP
:traffice? I assume I will use the private (10.21.55.x) to specify the
:destination since I have a dynamic WAN address.

Yes, you need to create the appropriate access list entries.
However, as the destination, you should specify the phrase

interface outside if you are using 6.3
interface if you are using 6.2

For example,

access-list out2in permit tcp host xxx.xxx.xxx.xxx interface outside 5631
access-list out2in permit udp host xxx.xxx.xxx.xxx interface outside 5632


: I have used dynamic DNS with a sonicWALL with no problems. Do yse see
:any problems with the Pix?

The PIX doesn't have any built-in support for dynamic DNS -- that is,
the PIX itself has no ability to contact something like dydns.org
to update a record. I don't -think- it tries to do a DNS update
in response to DHCP either, but perhaps they snuck that in.

 

Well I tried your suggestion with some mixed results but was not able to
connect. For starters I'm just working on Terminal Services rules only,
once I get them down I'm sure I can get the rest. I had some trouble with
the access-list syntax. I was eventually able to enter in the access-list
with then help of the GUI. Here is what was added.

name 209.xxx.xxx.xxx remoteuser2
access-list outside_access_in permit tcp host remoteuser2 eq 3389 host
10.21.55.5 eq 3389
access-group outside_access_in in interface outside
static (inside, outside) tcp interface 3389 10.21.55.5 3389 netmask
255.255.255.255 0 0

At the end of my reply is the running config.

I am not able to connect via terminal Services. Terminal Services works
behind the firewall but not from the outside address. I have a sonicwall
device on the outside address (209.xx.xxx.xxx) doing one-to-one NAT to my
workstation that I am not able to connect from.

Any Suggestions as to why this doesn't work?

Someone else originally set up the domain-name tgs.com in the PIX. This is
not their domain name. Does the PIX do any domain name resolution that
could be causing the problem?

You mentioned I cannot redirect telnet, how can I configure the PIX to allow
me to telnet from the outside address (209.xx.xxx.xxx) so I can manager it?

Is the order you entered important? I assume you enter the commands in the
configuration mode.

You have been a great help, any additional help would be appreciated.

Warren




PIX Version 6.2(2)
nameif ethernet0 outside security0
nameif ethernet1 inside security100
enable password cBLalUer5EqAPcp3 encrypted
passwd cBLalUer5EqAPcp3 encrypted
hostname tgs-sd1
domain-name tgs.com
fixup protocol ftp 21
fixup protocol http 80
fixup protocol h323 h225 1720
fixup protocol h323 ras 1718-1719
fixup protocol ils 389
fixup protocol rsh 514
fixup protocol rtsp 554
fixup protocol smtp 25
fixup protocol sqlnet 1521
fixup protocol sip 5060
fixup protocol skinny 2000
names
name 209.xxx.xxx.xxx remoteuser2
access-list outside_access_in permit tcp host remoteuser2 eq 3389 host
10.21.55.5 eq 3389
pager lines 24
interface ethernet0 10baset
interface ethernet1 10full
mtu outside 1500
mtu inside 1500
ip address outside dhcp setroute
ip address inside 10.21.55.1 255.255.255.0
ip audit info action alarm
ip audit attack action alarm
pdm location 10.21.55.0 255.255.255.0 inside
pdm location 10.21.55.0 255.255.255.255 inside
pdm location 10.21.55.5 255.255.255.255 inside
pdm location remoteuser2 255.255.255.255 outside
pdm logging informational 100
pdm history enable
arp timeout 14400
global (outside) 1 interface
nat (inside) 1 0.0.0.0 0.0.0.0 0 0
static (inside,outside) tcp interface 3389 10.21.55.5 3389 netmask
255.255.255.255 0 0
access-group outside_access_in in interface outside
timeout xlate 0:05:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 rpc 0:10:00 h323
0:05:00 sip 0:30:00 sip_media 0:02:00
timeout uauth 0:05:00 absolute
aaa-server TACACS+ protocol tacacs+
aaa-server RADIUS protocol radius
aaa-server LOCAL protocol local
http server enable
http 10.21.55.0 255.255.255.0 inside
no snmp-server location
no snmp-server contact
snmp-server community t1pt0p
no snmp-server enable traps
floodguard enable
no sysopt route dnat
telnet 10.21.55.0 255.255.255.0 inside
telnet timeout 5
ssh timeout 5
dhcpd address 10.21.55.33-10.21.55.64 inside
dhcpd dns 63.240.76.4 204.127.198.4
dhcpd lease 3600
dhcpd ping_timeout 750
terminal width 80
Cryptochecksum:cf2727c57c100279d753d7f3e4cc7332
: end

 

:name 209.xxx.xxx.xxx remoteuser2
:access-list outside_access_in permit tcp host remoteuser2 eq 3389 host 10.21.55.5 eq 3389
:access-group outside_access_in in interface outside
:static (inside, outside) tcp interface 3389 10.21.55.5 3389 netmask 255.255.255.255 0 0

The outside access list is evaluated before NAT is done. You need something
like:

access-list outside_access_in permit tcp host remoteuser2 eq 3389 interface outside eq 3389


:Someone else originally set up the domain-name tgs.com in the PIX. This is
:not their domain name. Does the PIX do any domain name resolution that
:could be causing the problem?

No, the PIX never does DNS itself.

:You mentioned I cannot redirect telnet, how can I configure the PIX to allow
:me to telnet from the outside address (209.xx.xxx.xxx) so I can manager it?

Don't do that. Use ssh instead. Go on to the pix, use a ca generate
command to generate a key, then use ca save all to save it on the PIX.
Then config ssh access to the outside.

If you really must use telnet to the outside, then it *must* be
contained within a VPN tunnel -- your crypto match acl access-list must
include a line that matches the outside interface.

 

I have tried what you suggested and some variants ...

access-list outside_access_in permit tcp host remoteuser2 eq 3389 interface
outside eq 3389
access-list outside_access_in permit tcp host remoteuser2 eq 3389 outside eq
3389
access-list outside_access_in permit tcp host remoteuser2 eq 3389 interface
eq 3389

and I get the same error...

ERROR: invalid IP address interface
[no] access-list <id> deny|permit <protocol>|object-group
<protocol_obj_grp_id>
<sip> <smask> | object-group <network_obj_grp_id>
[<operator> <port> [<port>] | object-group <service_obj_grp_id>]
<dip> <dmask> | object-group <network_obj_grp_id>
[<operator> <port> [<port>] | object-group <service_obj_grp_id>

It looks like it wants an actual IP address. Any other ideas how to
reference the interace since my WAN IP is dynamic and changes every 4 Days?

Warren

Houghton.

 

:access-list outside_access_in permit tcp host remoteuser2 eq 3389 interface outside eq 3389
:access-list outside_access_in permit tcp host remoteuser2 eq 3389 outside eq 3389
:access-list outside_access_in permit tcp host remoteuser2 eq 3389 interface eq 3389

:and I get the same error...

:ERROR: invalid IP address interface

Ah, sorry, looking back at previous posts, I see you are running 6.2(2).
You should upgrade to 6.2(3), by the way; see
http://www.cisco.com/warp/public/707/cisco-sa-20031215-pix.shtml

6.2 does not support the 'interface' keyword. You will have to use 'any':

access-list outside_access_in permit tcp host remoteuser2 eq 3389 any eq 3389

 

When I replaced the any in the access list it is accepted now. However it
still does not work. Ethernet0 name is outside. Would that have any
conflict with any reserved names? It accepted outside in the access-group
command for the name interface.

Is there some where I can monitor the connection to see where it is breaking
down on the PIX

Any othersuggestion to make this work.?

Thanks
Warren

 

To help troubleshoot I took out the destination host. The commands are
now...


static (inside, outside) tcp interface 3389 10.21.55.5 3389 netmask
255.255.255.255 0 0
access-list outside_access_in permit tcp any eq 3389 any eq 3389
access-group outside_access_in in interface outside

Still now luck.

Warren