would this be a correct dmz statment

[CiscoGuy79]

outside-->router-->inside---hosts

ip nat inside source static 192.168.1.100 int fa0/0
ip nat inside source static 192.168.1.120 int fa0/0
ip nat inside source static 192.168.1.140 int fa0/0

with fa0/0 being my outside interface

with these statements would they be open for everything and not blocked?

thanks
nathan

 

[ChrisAC]

No. You can't do a static mapping from the external address to three seperate internal addresses. If I connected to the external address on fa0/0, which internal address would that map to?

Chris.


**********************
Chris A.C, CCNA, CCSA
**********************

 

[GeneralDzur]

Chris is right - you have to specify a port. For instance (Just using arbitrary port numbers). CAPSLOCK indicates what I added.

ip nat inside source static TCP 192.168.1.100 25 int fa0/0 25
ip nat inside source static TCP 192.168.1.120 23 int fa0/0 23
ip nat inside source static TCP 192.168.1.140 80 int fa0/0 80

In this example, all traffic trying to get to whatever IP your external interface (fa0/0) has, would get piped inside to the specified addresses, on the specified ports.

Example: All traffic on port 25 (SMTP) would get re-directed to 192.168.1.100 on port 25. You can change the ports around, if it's going to another port for example. Change the first '25' to '30' if you wanted to pipe traffic to port 30.

Does that make sense?

- stephan

 

[CiscoGuy79]

Yes this makes sense, I have been using the port forwarding statements. I just thought there would be a way to put host(s) as a dmz that allows all ports through to that specific IP.

thanks guys again,

nathan

 

[GeneralDzur]

I think you can redirect all traffic to an internal host, but ONLY one, and it would probably prevent Dynamic NAT for everyone else (no one else could use the IP)

- stephan

 

[CiscoGuy79]

yes i tried this statement

ip nat inside source static 192.168.1.100 int fa0

and that forwarded everything to my internal ip and i couldn't even telnet to the router from the outside anymore because everything was forwarded. I was wondering if I could use another valid outside address and not fa0's ip address

like this:
ip nat inside source static 192.168.1.100 a.b.c.60

thanks
nathan