Cannot open website from outside

[marslove]

Cannot open website from outside.

access-list 122 permit tcp any eq domain any
access-list 122 permit udp any eq domain any
access-list 122 permit icmp any any
access-list 122 permit tcp any host 192.168.x.x eq

http://www established

access-list 122 permit tcp any any established
access-list 122 permit udp any any range 10000 20000
access-list 122 permit udp any any eq 5060
access-list 122 permit tcp any any eq 5060
access-list 122 permit tcp any any eq 3389
access-list 122 permit tcp any any eq 7000
access-list 122 permit tcp any eq ftp any established
access-list 122 permit tcp any gt 1024 any established
access-list 122 permit tcp any any eq 22
access-list 122 deny ip any any

This line should permit www
access-list 122 permit tcp any host 192.168.x.x eq

http://www established

If I remove access-group from inbound interface it works

Thanks

 

[imbadatthis]

the established part sys only allow them if there as been a connection started from INSIDE already ...
you have to remove that if you are allowing incoming

http://www ports..

We must go always forward, not backward
always up, not down and always twirling twirling towards infinity.

 

[marslove]

I tryed that by removing established
Still dos not work

Thanks

 

[ForumUser01]

I concur with 'imbadatthis'. After removing 'established' keyword, what IP you are trying to reach? 192.168.x.x is non routable on internet. Do you have static 'nat' configured on the router for this server? If so, allow the ACL to access public IP.

Hth
MS

 

[marslove]

Of coerce I am trying external IP. 192.168.x.x is internal IP address of

http://www-server

And its nated. Like so

“Ip nat inside source static tcp 192.168.x.x 80 interface fa0/0 80”

I sad when I remove access-group from the interface it works fine, that when I apply it Its stops working

Thanks

 

[unclerico]

You need to remove the host address in the ACE. When you remove the ACL from outside you are permitting all traffic inbound so when someone tries to get at your web server they will not have any issues. When you apply the ACL things are restricted. The specific ACE you are referring to will permit return traffic to 192.168.x.x which is not what you want. Remove the host entry from the ACE and re-apply the ACL. You should consider upgrading your IOS to the security image so you can run CBAC/ZBF so you have a stateful firewall.

I hate all Uppercase... I don't want my groups to seem angry at me all the time! =)
- ColdFlame (vbscript forum)

 

[marslove]

I removed host part and it worked

Thanks