Allow all traffic from one external IP inside

That would have to do with permitting new tcp connections to the server, not with permitting the traffic -from- the inside webserver to outside.

That tends to suggest you are concerned about new connections from outside to inside.

You asked about "any traffic", but you have permitted only tcp traffic. Change the 'tcp' to 'ip' for "any traffic" (or as close as the PIX gets.) The PIX won't allow through IPX traffic, for example, and it will not allow through tcp packets that suddenly appear "mid conversation" or tcp packets with incorrect sequence numbers, so it isn't the same as "all traffic"... but it's probably what you really want anyhow.

You will need a 'static' command or a 'nat 0 access-list' command that matches the public IP of the server to the internal IP, even if the internal IP is the same as the public IP. The PIX uses a two-part test: there has to be a translation to get the packet to the right place, and the attempted traffic must fit within the access controls configured via the access-group command.

I basically have the webserver outside the firewall trying to access a DB inside the firewall on ports 3050 and 3051 - I want to test it out without creating a long ACL. So I want to allow any tcp traffic on any port coming from our Webserver to our DB server temporarily to make sure it works. I want to know if I have to clear the existing NAT stuff in order to populate this new rule or if I can just add it in.

Just add in

access-list out_in permit tcp any host IP range 3050 3051

and the appropriate static command.

Sorry, I did not notice the 'eq any' earlier. That part is wrong.

Thanks ! - At the end of the access and static rules we have a command

access-group out_in in interface outside

Do I need to reenter this one once I add the new commands to refresh it ?

In article , Paul wrote: [PIX 6]

Not if you only -modify- the access-list named. If you completely delete the access-list named then the PIX will immediately remove the access-group command from the configuration -- so if you want to update an access list by clearing it and entering the new version, you have to re-enter the access-group command. That does not apply if you change the access-list in place without removing it.

Sweet ! thankyou for your help and so fast too.

One last thing - do I need to do a 'write mem' to ensure the rule sticks ?

In article , Paul wrote: [PIX]

Yes.