Cisco 877 - Stealth Port Scan

dialer0 is your outside interface, so the "in" access-group will be processed

-before- NAT is applied. Thus it must have the public destinations.

Thanks for the reply Walter.

Can you or some one elaborate on what I need to do exactly?

Anyone...? =)

You need to add to the ACL 102 permit statements to allow your inbound traffic in.

You NEED to specify the address of dialer 0. If you have a dynamic address then this will be a limitation but unless you are getting hit from your ISP you will be able to work around it.

Lets use a.b.c.d to represent your dialer 0 IP address.

This one does nothing useful to you access-list 102 permit ip any 192.168.0.0 0.0.0.255

You do need: access-list 102 permit udp any host a.b.c.d eq 9002 access-list 102 permit tcp any host a.b.c.d eq 9002 access-list 102 deny ip any any

If your IP address changes a lot you could do something like

access-list 102 permit udp any a.b.0.0 0.0.255.255 eq 9002 access-list 102 permit tcp any a.b.0.0 0.0.255.255 eq 9002 access-list 102 deny ip any any

Choose the wildcard length to match your possible IP address range.

The above worked like a charm so give yourself a pat on the back for a job well done.

Thanks so much!

Doh! I spoke too soon.

My port forwards are still broken, the ports are stealth though.

Here is an example of the my port forward if it will help at all.

ip nat inside source static tcp 192.168.0.9 9009 interface Dialer0 9009 ip nat inside source static udp 192.168.0.9 9009 interface Dialer0 9009

I have it figured out now so sorry about the last post.

For anyone interested, I had to create an ACL for every port forwarded. =)

Hide quoted text -

That would be required.