PIX 506E - Allow external access to internal server

[chamig]

I have an internal security camera server that I need to access from outside the network. The specific port the camera software uses is 32001 and the server has been assigned a static address of: 192.168.1.100

I have tried several things, but cannot seem to get it to work. I cannot get it work inside the network either, so there is something blocking it there as well. I have added everything to the access-list I can think of, but nothing seems to be working. Below is my config. If anybody has any suggestions, I would greatly appreciate it.

PIX Version 6.3(4)
interface ethernet0 100full
interface ethernet1 100full
nameif ethernet0 outside security00
nameif ethernet1 inside security10
hostname Gatekeeper
fixup protocol dns maximum-length 512
fixup protocol ftp 21
fixup protocol h323 h225 1720
fixup protocol h323 ras 1718-1719
fixup protocol http 80
fixup protocol rsh 514
fixup protocol rtsp 554
fixup protocol sip 5060
fixup protocol sip udp 5060
fixup protocol skinny 2000
fixup protocol smtp 25
fixup protocol sqlnet 1521
fixup protocol tftp 69
names
access-list acl_inside permit ip any any
access-list acl_inside permit icmp any any
access-list acl_outside permit icmp any any
access-list acl_outside permit ip any any
access-list 101 permit ip 192.168.0.0 255.255.255.0 host 66.66.66.66
access-list 101 permit icmp 192.168.1.0 255.255.255.0 any
access-list 101 permit ip 192.168.1.0 255.255.255.0 any
access-list 101 permit icmp 192.168.0.0 255.255.255.0 host 66.66.66.66
pager lines 24
mtu outside 1500
mtu inside 1500
ip address outside 206.206.206.107 255.255.255.248
ip address inside 192.168.0.2 255.255.255.0
ip audit info action alarm
ip audit attack action alarm
pdm logging informational 100
pdm history enable
arp timeout 14400
global (outside) 1 206.206.206.108
global (outside) 2 206.206.206.109
nat (inside) 1 192.168.0.0 255.255.255.0 0 0
nat (inside) 2 192.168.1.0 255.255.255.0 0 0
access-group 101 in interface outside
access-group 101 in interface inside
conduit permit tcp host 192.168.0.9 any
route outside 0.0.0.0 0.0.0.0 206.206.206.105 1
route inside 192.168.1.0 255.255.255.0 192.168.1.1 1
timeout xlate 0:05:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 rpc 0:10:00 h225 1:00:00
timeout h323 0:05:00 mgcp 0:05:00 sip 0:30:00 sip_media 0:02:00
timeout uauth 0:05:00 absolute
aaa-server TACACS+ protocol tacacs+
aaa-server TACACS+ max-failed-attempts 3
aaa-server TACACS+ deadtime 10
aaa-server RADIUS protocol radius
aaa-server RADIUS max-failed-attempts 3
aaa-server RADIUS deadtime 10
aaa-server LOCAL protocol local
http server enable
http 192.168.1.0 255.255.255.0 inside
no snmp-server location
no snmp-server contact
snmp-server community public
no snmp-server enable traps
floodguard enable
telnet timeout 5
ssh timeout 5
console timeout 0
dhcpd lease 3600
dhcpd ping_timeout 750
terminal width 80
: end

 

[Supergrrover]

I think this is the problem - your internal network is 192.168.0.0 and the IP of the server is 192.168.1.100
those two networks can't see each other without a router between them.

For the external access

static (inside,outside) tcp [EXTERNAL_IP] 32001 192.168.0.100 32001 netmask 255.255.255.255
access-list inbound permit tcp any host [EXTERNAL_IP] eq 32001
access-group inbound in interface outside


Take this line out
access-group 101 in interface inside

everything is allowed out by default.


Brent
Systems Engineer / Consultant
CCNP, CCSP

 

[boymarty24]

It seems that there is a router on the network if you look at the route inside statement. Is that correct?

If you already have a router remember that the pix doesnt allow intra traffic on the inside interface. For internal access you need to set your clients to use the router address ( 192.168.1.1 ) as default gateway. Using the pix as DG will not work.

 

[Supergrrover]

The route statement routes back to itself.
route inside 192.168.1.0 255.255.255.0 192.168.1.1 1
The pix will be unable to reach it without a gateway IP on one of it's subnets.

If an internal router exists, you will need to change your route statement
route inside 192.168.1.0 255.255.255.0 [192.168.0.router_IP] 1



Brent
Systems Engineer / Consultant
CCNP, CCSP

 

[boymarty24]

You are right Brent =) I just saw the route inside statement and thought that a router was in place.