Opening a Port on PIX515

[life036]

Hi All,

I'm trying to open some ports on my PIX515 to enable iChat / AIM communication over the internet. Now, I've opened ports before using the following two commands for example:

1) access-list server_access permit tcp any host 72.*.*.* eq www
(This line to 'permit' the port)
2) static (inside,outside) tcp 72.*.*.*

http://www 192.168.*.*

http://www netmask

255.255.255.255 0 0
(And this line to create a route for the traffic to go)

My question is, what if we don't have a static route for the traffic to go? Anyone and everyone will want to use a video chat application sooner or later, so how can I let the firewall know that the traffic on these ports can go to anyone? I've only used these commands for servers with static IPs before, so I'm a little unclear on the procedure for just opening a port to any and all traffic, no matter what it's destination is.

 

[drbk563]

You can do so only if the internal servers use different services on different ports.
An example would be if you had.

http://www server

= 10.1.122.222
ftp server = 10.1.122.123
email server = 10.1.122.124

static (inside,outside) tcp interface 80 10.1.122.222 80 netmask 255.255.255.255
static (inside,outside) tcp interface 21 10.1.122.123 21 netmask 255.255.255.255
static (inside,outside) tcp interface 20 10.1.122.123 20 netmask 255.255.255.255
static (inside,outside) tcp interface 25 10.1.122.222 25 netmask 255.255.255.255

You can replace the word interface with any single public IP available

 

[life036]

Hi DRBK,

That looks like what I'm doing already with my servers. I have no problem opening ports in that fashion.

You see, I'm not trying to get the traffic to go to my local servers. Rather, I'm trying to open the iChat ports and let the traffic go to whatever host is requesting it. I just want to blow the port wide open, and not direct the traffic to any server at all.

You see, there is no way I can know which user/host is going to be using iChat, so pointing the traffic to a specific local host would be pointless. I just want to make it like there is no firewall, for a select few ports.

See where I'm going with this?

Thanks,
Chris