Port Forwarding

[arastaf]

I am trying to forward ports for utorrent, and SMTP to my server. But I have been unable to do so, and after reading quite a few posts saying to do the same things, with no luck. I was hoping someone could look at my config and help me figure out what I am doing wrong.

The Ports I want to forward are 8181, 8282, 15654, and 25. I do have not 25 setup yet, as I havent gotten the others to work and need to figure it out before I worry about setting up exchange.

The Servers IP I am forwarding them to is 192.168.15.10 named Logi. And I am using a Dynamic IP.



ASA Version 7.2(4)
!
hostname Link
domain-name QQucumber.com
enable password NONONONONONONO encrypted
passwd NONONONONONONO encrypted
names
name 192.168.15.10 Logi
!
interface Vlan1
nameif inside
security-level 100
ip address 192.168.15.1 255.255.255.0
!
interface Vlan2
nameif outside
security-level 0
pppoe client vpdn group CenturyTel
ip address pppoe setroute
!
interface Vlan3
shutdown
no forward interface Vlan1
nameif dmz
security-level 50
no ip address
!
interface Ethernet0/0
switchport access vlan 2
!
interface Ethernet0/1
!
interface Ethernet0/2
!
interface Ethernet0/3
!
interface Ethernet0/4
!
interface Ethernet0/5
!
interface Ethernet0/6
!
interface Ethernet0/7
!
ftp mode passive
dns server-group DefaultDNS
domain-name QQucumber.com
object-group service uTorrent tcp
port-object eq 15654
object-group service uTorrent_Web_UI tcp
port-object eq 8181
port-object eq 8282
access-list Superman_splitTunnelAcl standard permit any
access-list outside_access_in extended permit tcp any eq 8181 host Logi eq 8181
access-list outside_access_in extended permit tcp any host Logi eq 8282
access-list outside_access_in extended permit tcp any host Logi eq 15654
access-list outside-in-1 extended permit tcp any host Logi eq 15654
access-list outside-in-1 extended permit tcp any host Logi eq 8080
pager lines 24
logging asdm informational
mtu inside 1500
mtu outside 1500
mtu dmz 1500
ip local pool remotepool 192.168.15.121-192.168.15.125 mask 255.255.255.0
icmp unreachable rate-limit 1 burst-size 1
asdm image disk0:/asdm-524.bin
no asdm history enable
arp timeout 14400
nat-control
global (outside) 1 interface
nat (inside) 1 0.0.0.0 0.0.0.0
static (inside,outside) tcp interface 15654 Logi 15654 netmask 255.255.255.255
static (inside,outside) tcp interface 8080 Logi 8080 netmask 255.255.255.255
access-group outside-in-1 in interface outside
timeout xlate 3:00:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
http server enable
http 192.168.15.0 255.255.255.0 inside
no snmp-server location
no snmp-server contact
snmp-server enable traps snmp authentication linkup linkdown coldstart
crypto ipsec transform-set ESP-AES-256-SHA esp-aes-256 esp-sha-hmac
crypto dynamic-map outside_dyn_map 20 set pfs group5
crypto dynamic-map outside_dyn_map 20 set transform-set ESP-AES-256-SHA
crypto map outside_map 65535 ipsec-isakmp dynamic outside_dyn_map
crypto map outside_map interface outside
crypto isakmp enable outside
crypto isakmp policy 10
authentication pre-share
encryption aes-256
hash sha
group 5
lifetime 86400
crypto isakmp nat-traversal 20
telnet timeout 5
ssh timeout 5
console timeout 0
management-access inside
vpdn group CenturyTel request dialout pppoe
vpdn group CenturyTel localname jprehm
vpdn group CenturyTel ppp authentication pap
vpdn username NONONONONO password *********
dhcpd auto_config outside
!
dhcpd address 192.168.15.101-192.168.15.120 inside
dhcpd dns Logi interface inside
dhcpd enable inside
!

ssl encryption aes256-sha1 3des-sha1 aes128-sha1 des-sha1 rc4-md5
group-policy Superman internal
group-policy Superman attributes
vpn-tunnel-protocol IPSec
split-tunnel-policy tunnelspecified
split-tunnel-network-list value Superman_splitTunnelAcl
username NONONONONONONO password NONONONONONONO encrypted privilege 0
username japrehm attributes
vpn-group-policy Superman
tunnel-group Superman type ipsec-ra
tunnel-group Superman general-attributes
address-pool remotepool
default-group-policy Superman
tunnel-group Superman ipsec-attributes
pre-shared-key *
!
class-map inspection_default
match default-inspection-traffic
!
!
policy-map type inspect dns preset_dns_map
parameters
message-length maximum 512
policy-map global_policy
class inspection_default
inspect dns preset_dns_map
inspect ftp
inspect h323 h225
inspect h323 ras
inspect rsh
inspect rtsp
inspect esmtp
inspect sqlnet
inspect skinny
inspect sunrpc
inspect xdmcp
inspect sip
inspect netbios
inspect tftp
!
service-policy global_policy global
prompt hostname context
Cryptochecksum:6ac952539a10131ba734f866601c7105
: end

 

[unclerico]

access-list outside_access_in extended permit tcp any interface outside eq 8181
access-list outside_access_in extended permit tcp any interface outside eq 8182
access-list outside_access_in extended permit tcp any interface outside eq 15654
access-list outside_access_in extended permit tcp any interface outside eq smtp

static (inside,outside) tcp interface 8181 host Logi 8181 netmask 255.255.255.255
static (inside,outside) tcp interface 8182 host Logi 8182 netmask 255.255.255.255
static (inside,outside) tcp interface 15654 host Logi 15654 netmask 255.255.255.255
static (inside,outside) tcp interface smtp host Logi smtp netmask 255.255.255.255

ip access-group outside_access_in in interface outside
[code]
you'll definitely want to register with a dynamic ip service such as dyndns.org and install an update agent on a machine inside of your network to update the ip each time it changes. You will get blacklisted in about 20 seconds if your Exchange mail is coming from a dynamic IP without a PTR record.

[i]I hate all Uppercase... I don't want my groups to seem angry at me all the time! =)[/i]
- ColdFlame (vbscript forum)

 

[arastaf]

Thanks for the reply unclerico, that worked great. I swear I used that at one point, but had only tested it from inside the network, which thinking about it now wont work as the ASA will forward all of the replies back to the server.

Good call on the tip, also. Many thanks.