在 Cisco 1841 上允许端口 8080

网络工程 思科 路由 路由器 防火墙 思科-ios
2022-03-04 09:37:31

将 1841 配置为在将某些端口映射到内部地址时允许外部访问时遇到问题。

需要允许以下内容:

外部 IP:端口 8080 到 192.168.3.50 外部 IP:端口 8081 到 192.168.3.51

这是1841的配置:

FT-ROUTER#sh run
Building configuration...

Current configuration : 2394 bytes
!
version 12.4
service timestamps debug datetime msec
service timestamps log datetime msec
no service password-encryption
!
hostname FT-ROUTER
!
boot-start-marker
boot system flash c1841-ipbasek9-mz.124-20.T.bin
boot-end-marker
!
logging message-counter syslog
!
no aaa new-model
ip source-route
!
ip dhcp excluded-address 192.168.3.1 192.168.3.5
ip dhcp excluded-address 192.168.2.1 192.168.2.5
ip dhcp excluded-address 192.168.1.1 192.168.1.5
!         
ip dhcp pool MAINDATA
   network 192.168.1.0 255.255.255.0
   default-router 192.168.1.1 
   dns-server 68.105.28.16 68.105.29.16 
!
ip dhcp pool PUBLICWIFI
   network 192.168.2.0 255.255.255.0
   default-router 192.168.2.1 
   dns-server 68.105.28.16 68.105.29.16 
!
ip dhcp pool SECURITY
   network 192.168.3.0 255.255.255.0
   default-router 192.168.3.1 
   dns-server 68.105.28.16 68.105.29.16 
!
!
ip cef
no ip domain lookup
!

interface FastEthernet0/0
 ip address 98.190.71.2 255.255.255.240
 ip nat outside
 ip virtual-reassembly
 duplex auto
 speed auto
!
interface FastEthernet0/1
 no ip address
 duplex auto
 speed auto
!
interface FastEthernet0/1.100
 description FT-MAIN-DATA
 encapsulation dot1Q 100
 ip address 192.168.1.1 255.255.255.0
 ip nat inside
 ip virtual-reassembly
!
interface FastEthernet0/1.200
 description FT-PUBLIC-WIRELESS
 encapsulation dot1Q 200
 ip address 192.168.2.1 255.255.255.0
 ip nat inside
 ip virtual-reassembly
!
interface FastEthernet0/1.300
 encapsulation dot1Q 300
 ip address 192.168.3.1 255.255.255.0
 ip nat inside
 ip virtual-reassembly
!

!
ip default-gateway 98.190.71.1
ip forward-protocol nd
ip route 0.0.0.0 0.0.0.0 98.190.71.1
!
ip nat inside source list 10 interface FastEthernet0/0 overload
!
access-list 10 permit 192.168.1.0 0.0.0.255
access-list 10 permit 192.168.2.0 0.0.0.255
access-list 10 permit 192.168.3.0 0.0.0.255

这是一个基本图:

网络图

2个回答

下面是一个常规的静态 PAT 语句。

ip nat inside source static tcp 192.168.3.50 8080 98.190.71.2 8080 extendable
ip nat inside source static tcp 192.168.3.51 8081 98.190.71.2 8081 extendable

这可能是 UDP 流量所需要的。

ip nat inside source static udp 192.168.3.50 8080 98.190.71.2 8080 extendable
ip nat inside source static udp 192.168.3.51 8081 98.190.71.2 8081 extendable

您的要求似乎是入站流量,想要从外部网络访问托管在内部网络中的服务器。要建立这种连接,必须在边缘设备或外围设备中配置静态 natting。

静态 NAT

Routet(config)# ip nat inside souce static 192.168 .3.50 XXXX eq 8080

Router(config)#ip nat inside souce static 192.168 3.51 XXXX eq 8081

其中 XXXX 是外部的,即公共 IP 地址