1. Home
  2. Cisco Systems
  3. Exposed Host on C850

Exposed Host on C850

Hi,

i have a problem with my Cisco 850W Router. Its working nice so far, but i have problems with Peer2Peer programms and some other applications, which require incoming connections. Some of them use a random port, so i cant just forward one port and i dont wanna forward so many ports.

So i searched long and only thing i found is to set an exposed host (so all traffic which isnt specified to be forwarded to a certain port, will be redirected to my PC). Don't tell me, that its not good for security, i don't care. I have a softwarefirewall for security and wanna get rid of the problems with programms requiring incoming connections.

Bad thing is, i havent found any information on how to set an "exposed host" on a cisco router. Even in the cisco documents for certified cisco training there wasn't a single word about exposed hosts.

On some cheap retail routers, this function is also called DMZ (its not real dmz on cheap servers, but exposed hosts just the companies call it DMZ).

Can anyone help me with this?

P.S. Some specs about the server and IOS:

ROM: System Bootstrap, Version 12.3(8r)YI2, RELEASE SOFTWARE ROM: Cisco IOS Software, C850 Software (C850-ADVSECURITYK9-M), Version

12.3(8)YI 2, RELEASE SOFTWARE (fc1) System image file is "flash:c850-advsecurityk9-mz.123-8.YI2.bin"

Bye Tseng

Reply to
Tseng
Loading thread data ...

"Tseng" schrieb im Newsbeitrag news:fa06t2$the$00$ snipped-for-privacy@news.t-online.com...

Anyone know how to do it?

Reply to
Tseng

Newsbeitragnews:fa06t2$the$00$ snipped-for-privacy@news.t-online.com...

You are talking about a 1:1 nat with a single host IP. Although this will probably break your other communications to other nodes on the inside. Linksys and Dlink and the like created the DMZ host were all traffic that was not initiated from internally (therefore non-link state) was pushed to a DMZ host, but anything else was forwarded as needed based on the link-state table. I'm not sure that a Cisco router will do this. You can do a 1:1 NAT, but then everything to that IP is going to get forwarded to that one internal IP. If you do many:1, this will do the link state as needed, but incoming un- requested traffic will be blocked unless you port forward. Generally speaking, decently designed applications always use a standard destination port and a random source....so you need to forward based on the incoming destination port (your box). The other side's random source port doesn't matter. I'm sure they are out there, but I have worked for two extremely large companies and do not recall any apps that randomize destination port in recent memory.

Reply to
Trendkill

I thinkt that's what i need. Before i got the router, my PC was directly connected to the internet and everything was working without problems and my brother was connected to the internet through ICS. And routers for Home use, have this kind of behaviour too, so it's hard for me too understand that a highquality router like cisco ones, have problems (or just pretty hard) to set up such a feature.

I'm aware that this isn't a good/secure thing too do, but it's for home use and not in a company where you have to put maximum security.

Reply to
Tseng

A pix will definitely do it, but a traditional router probably will not. May get lucky with the firewall feature set, but hopefully someone else on the board has expertise here.

Reply to
Trendkill

Perhaps this:

NAT Default Inside Server

formatting link
Rgds, Martin

Reply to
Martin Gallagher

formatting link
Thank you very much, this did it. Looking now at it, it was pretty easy to setup. I just didn't know, that "NAT Default Inside Server" is the other description of "exposed host" ^^

ip nat inside source static 192.168.0.2 interface Dialer0

did the work. Just DNS resovling didn't worked first, cause my PC was set to use the DNS of the Router. So i had to add

ip nat inside source static udp 192.168.0.1 53 interface dialer0 53

Now, it works again.

Reply to
Tseng

Cabling-Design.com Forums website is not affiliated with any of the manufacturers or service providers discussed here. All logos and trade names are the property of their respective owners.