Actually no.
X.X.X.X - your WAN (interface) ip
x.x.x.x - internal host ip
You need to enter three commands:
access-list inmap permit tcp any host X.X.X.X eq 3389
--- allow port access thru pix (example for terminal server (RDP)- 3389)
access-group inmap in interface outside
--- bind access list to interface
static (inside,outside) tcp interface 3389 x.x.x.x 3389 netmask
255.255.255.255 0 0
--- be aware that this is one line command; it was wrapped by my mail
client
--- this is the actual static mapping from outside ip to internal ip
--- you can have multiple static commands for various ports ie. smtp,
ssh, --- https, ...
--- you need separate access-list for each static mapping
these commands are taken from the actual configuration, you can consult
the pix command line help for general command description (command ?
--- ie. access-list ?)
I have couple of PIX firewalls, all working very nice with multiple
static mappings ...
With regards,
Milos
-----Original Message-----
From: Brett [mailto:bretticus@gmail.com]
Sent: Wednesday, March 16, 2005 5:06 PM
To: firewalls@securityfocus.com
Subject: PIX 501 Port forwarding
Hi,
I have a client who has installed a PIX 501. The client was given just
one ip address which has been configuered as the outside interface.
The end result is they want to forward http traffic to a Web server
within. PAT is configured via:
global (outside) 1 interface
nat (inside) 1 0.0.0.0 0.0.0.0 0 0
The problem is that it appears one cannot static the outside interface
to a local address (I assume this is true from the config examples I
have seen on the Web.) I have also witnessed my ssh connection drop
when I try ;-) On a cheap Linksys (etc.) this is trivial. Do I really
need two routable ip addresses so that one can be the outside
interface on the PIX and the other ip map to an inside address?
Thanks!
------------------------------------------------------------------------
--
FREE Download - The Future in Desktop Firewalls is Available Now
NEW NetOp Desktop Firewall, the world's first driver-centric
firewall software - protecting your laptops and corporate PCs at
ring-zero! NetOp features sophisticated process & application
control, centralized management and multiple network user profiles -
NetOp is able to increase security when mobile users plug back
into your network. Step into a more secure future - Try it FREE
http://www.securityfocus.com/sponsor/CrossTec_firewalls_050315
------------------------------------------------------------------------
--
--------------------------------------------------------------------------
FREE Download - The Future in Desktop Firewalls is Available Now
NEW NetOp Desktop Firewall, the world's first driver-centric
firewall software - protecting your laptops and corporate PCs at
ring-zero! NetOp features sophisticated process & application
control, centralized management and multiple network user profiles -
NetOp is able to increase security when mobile users plug back
into your network. Step into a more secure future - Try it FREE
http://www.securityfocus.com/sponsor/CrossTec_firewalls_050315
--------------------------------------------------------------------------
