Pix 501 Port Forwarding

[MadHatter]

Hi guys,

First of all let me apologize in advance for being very n00b with this stuff.

I recently purchased and configured my pix501. Everything basic is working fine, but now I would like to forward ports on it. From what I understand I have to setup an access rule. I tried setting one up for BT, one for vnc, and one for ssh. When I added these to the list of access rules, I could not access anything from that pc. I tried deleting the access rules but every time it came up with the error -

“[ERR]no access-list outside_access_in permit tcp host (EXT IP) host (LOCAL PC) eq 22
Specified access-list does not exist
[OK] access-group outside_access_in in interface outside”

I finally got web access by deleting the pc in hosts, but still dont know how to get the port forwarding working.

One small thing I noticed but dont know if it has any relevance: on the local machine the mask is 255.255.255.0 and in the pix config it is 255.255.255.255 and wont let me change it.

Any help would be much appreciated!

If you need any further information just let me know.

 

[Boscoh]

The 255.255.255.255 mask on the PIX just means that it is referencing a single host, rather than a subnet.

Port forwarding is accomplished using the "static" command.

 

[BobSutan]

static (inside,outside) tcp interface ftp host abc ftp netmask 255.255.255.255

Substitute tcp for udp if need be, and ftp for whatever port you wish to forward. Host abc can be whatever you want as well.