How to setup port forwarding in PIX 501?

port forwarding is called port redirection in PIX parlance

see

ttp://

Thank you Merv!

Command:

ip address outside 71.155.211.233 255.255.255.0

ip address inside 192.168.1.1 255.255.255.0

static (inside,outside) tcp interface www 192.168.1.99 www netmask

Am I doing right?

Thanks a lot!

Charlie

Charlie, I think everything is correct, except I dont think the interface is needed. This should do

static (inside,outside) tcp www 192.168.1.99 www netmask

This link might help in configuring the pix firewall for the average stuff:

Thank you James.

I believe that static is okay.

You will also need an an access-list to permit the traffic as it is coming from outside

access-list WEBSERVER permit tcp any host 71.155.211.233 eq 80

access-group WEBSERVER in interface outside

Please quote context. Please see here for information on how to do so from Google Groups:

That syntax is not valid for any PIX software release.

static PAT *must* be of one of these forms:

static (INTERFACE1,INTERFACE2) PROTOCOL IPADDRESS2 PORT2 IPADDRESS1 PORT1 netmask NETMASK

static (INTERFACE1,INTERFACE2) PROTOCOL interface PORT2 IPADDRESS1 PORT1 netmask NETMASK

static (INTERFACE1,INTERFACE2) PROTOCOL IPADDRESS2 access-list ACCESSLIST

There are also some forms in which the interface and addresses are reversed.

Although the official syntax would allow for the possibility of (e.g.)

static (INTERFACE1,INTERFACE2) PROTOCOL interface PORT2 interface PORT1 netmask NETMASK

in practice using 'interface' twice cannot work in either standard or reversed NAT.

Rob, Thanks for the correction. My bad, I did remove that previous post. And thanks again for the how to reply to Google Groups:

Thank you James

Thanks Merv and Rob,

Here is the multiple line command i have:

ip address outside 71.155.211.233 255.255.255.0 ip address inside 192.168.1.1 255.255.255.0 static (inside,outside) tcp interface www 192.168.1.99 www netmask

Will this work? Thanks again.

Charlie

Who is Rob?

No, substitute

access-list WEBSERVER permit tcp any interface eq www

It returns the following error message:

Result of firewall command: "access-list 192.168.1.99 permit tcp any interface eq www "

interface does not exist Usage: [no] access-list compiled [no] access-list deny-flow-max [no] access-list alert-interval [no] access-list object-group-search [no] access-list compiled [no] access-list [line ] remark [no] access-list [line ] deny|permit |object-group | interface | object-group

| interface | object-group

Result of firewall command: "access-group 192.168.1.99 in interface outside"

ERROR: access-list does not exist Usage: [no] access-group in interface [per-user-override] Command failed

it seems "eq" is not accepted in the syntax.. Sorry for the headaches caused..

Thanks.

Charlie

Did you already have a name command for WEBSERVER in your config ?

Anyways try this instead:

ip address outside 71.155.211.233 255.255.255.0 ip address inside 192.168.1.1 255.255.255.0 static (inside,outside) tcp interface www 192.168.1.99 www netmask

interface eq www "

Yes. I named 192.168.1.99 as WEBSERVER

Error message returned for this command: interface doesn't exist all the first three commands work fine but I am stuck by creating an access-list.. Thanks Merv.

access-list WEB_SERVER_ACL permit tcp any interface outside eq www

now everything is working perfectly. Thanks Walter and Merv for the greatest help!

For future reader's reference, here is what I did for setting up port forwarding in PIX 501.

ip address outside 71.155.211.233 255.255.255.0 ip address inside 192.168.1.1 255.255.255.0 static (inside,outside) tcp interface www 192.168.1.99 www netmask