Hey all I have worked with the PIXes for quite a while, but never quite like this.
I have a PIX 506 and have a single public IP address assigned by PPPOE. The DSL Modem is in Bridge mode and the PIX is connecting to the internet like it's supposed to. This setup is similar to the situation in thread35-1218772 but we have about 20 stations and one server that needs all the ports.
Everyone can get to the internet but it appears none of the ports are coming through. Here's the majority of the config.
[tt]PIX Version 6.3(4)[/tt]
<snip>
[tt]fixup protocol dns maximum-length 65535[/tt]
<snip>
[tt]access-list inbound permit tcp any host 192.168.111.250 eq 3389
access-list inbound permit tcp any host 192.168.111.250 eq smtp
access-list inbound permit tcp any host 192.168.111.250 eq domain
access-list inbound permit tcp any host 192.168.111.250 eq www
access-list inbound permit tcp any host 192.168.111.250 eq 135
access-list inbound permit tcp any host 192.168.111.250 eq 445
access-list inbound permit tcp any host 192.168.111.250 eq 3268
access-list inbound permit tcp any host 192.168.111.250 eq 4125
access-list inbound permit tcp any host 192.168.111.250 range 4900 4903
access-list inbound permit tcp any host 192.168.111.250 eq 88
access-list inbound permit tcp any host 192.168.111.250 eq ldap
access-list inbound permit udp any host 192.168.111.250 eq domain
access-list inbound permit udp any host 192.168.111.250 eq 88
access-list inbound permit udp any host 192.168.111.250 eq 389
access-list inbound permit udp any host 192.168.111.250 eq ntp[/tt]
<snip>
[tt]ip address outside pppoe setroute
ip address inside 192.168.111.1 255.255.255.0[/tt]
<snip>
[tt]global (outside) 1 interface
nat (inside) 1 0.0.0.0 0.0.0.0 0 0
access-group inbound in interface outside[/tt]
<snip>
[tt]vpdn group INTERNET request dialout pppoe
vpdn group INTERNET localname blah
vpdn group INTERNET ppp authentication mschap
vpdn username blah password *********[/tt]
<snip>
I first set the ports up like I usually do when I have a range of public IP addresses using this:
[tt]static (inside,outside) PUBLIC-IP PRIVATE-IP netmask 255.255.255.255
conduit permit tcp host PUBLIC-IP eq 3389 any[/tt]
The problem there is that since I was forcing the only public IP to map to the private IP of the server, I could only get on the internet from the server. The stations were down!! So I took that out.
Any help would be greatly appreciated.
Thanks
<<Witty Signature>>
I have a PIX 506 and have a single public IP address assigned by PPPOE. The DSL Modem is in Bridge mode and the PIX is connecting to the internet like it's supposed to. This setup is similar to the situation in thread35-1218772 but we have about 20 stations and one server that needs all the ports.
Everyone can get to the internet but it appears none of the ports are coming through. Here's the majority of the config.
[tt]PIX Version 6.3(4)[/tt]
<snip>
[tt]fixup protocol dns maximum-length 65535[/tt]
<snip>
[tt]access-list inbound permit tcp any host 192.168.111.250 eq 3389
access-list inbound permit tcp any host 192.168.111.250 eq smtp
access-list inbound permit tcp any host 192.168.111.250 eq domain
access-list inbound permit tcp any host 192.168.111.250 eq www
access-list inbound permit tcp any host 192.168.111.250 eq 135
access-list inbound permit tcp any host 192.168.111.250 eq 445
access-list inbound permit tcp any host 192.168.111.250 eq 3268
access-list inbound permit tcp any host 192.168.111.250 eq 4125
access-list inbound permit tcp any host 192.168.111.250 range 4900 4903
access-list inbound permit tcp any host 192.168.111.250 eq 88
access-list inbound permit tcp any host 192.168.111.250 eq ldap
access-list inbound permit udp any host 192.168.111.250 eq domain
access-list inbound permit udp any host 192.168.111.250 eq 88
access-list inbound permit udp any host 192.168.111.250 eq 389
access-list inbound permit udp any host 192.168.111.250 eq ntp[/tt]
<snip>
[tt]ip address outside pppoe setroute
ip address inside 192.168.111.1 255.255.255.0[/tt]
<snip>
[tt]global (outside) 1 interface
nat (inside) 1 0.0.0.0 0.0.0.0 0 0
access-group inbound in interface outside[/tt]
<snip>
[tt]vpdn group INTERNET request dialout pppoe
vpdn group INTERNET localname blah
vpdn group INTERNET ppp authentication mschap
vpdn username blah password *********[/tt]
<snip>
I first set the ports up like I usually do when I have a range of public IP addresses using this:
[tt]static (inside,outside) PUBLIC-IP PRIVATE-IP netmask 255.255.255.255
conduit permit tcp host PUBLIC-IP eq 3389 any[/tt]
The problem there is that since I was forcing the only public IP to map to the private IP of the server, I could only get on the internet from the server. The stations were down!! So I took that out.
Any help would be greatly appreciated.
Thanks
<<Witty Signature>>