Newsgroup: it.comp.reti.cisco
Titolo: dove sbaglio ?

Salve a tutti
Sto cercando di capire dove sto sbagliando. Ho un server web interno
192.168.1.10 che vorrei fosse visto anche dall'esterno in quanto mi sono
preso un dyn dns e volevo provarlo. Nella conf che segue ho impostato un nat
statico che reindirizza il web server sulla porta dialer1 esterna. Attivando
ip http server e digitando l'url mi richiama la pagina di accesso al router
quindi il servizio dns funziona solo che non riesco a far vedere il mio
server interno.Le access-list sono impostate in modo da far passare le
richieste su porta 80 e quando faccio la richiesta mi  A questo punto mi
rivolgo a voi esperti se sapete darmi una dritta !
Halo67
Current configuration : 5199 bytes
!
! Last configuration change at 23:26:40 ITA Sun Aug 20 2006 by halo67
!
version 12.3
no service pad
service tcp-keepalives-in
service tcp-keepalives-out
service timestamps debug datetime msec localtime show-timezone
service timestamps log datetime msec localtime show-timezone
service password-encryption
service sequence-numbers
!
hostname Ancona1
!
security authentication failure rate 3 log
security passwords min-length 6
logging buffered 51200 debugging
logging console critical
enable secret 5 $1$e7NA$eJT0lPN2Otcyec1STDr2q.
!
username **** secret 5 $1$3OWa$rOHpR8tZ5I9N4WqUnnKjL/
clock timezone ITA 1
clock summer-time ITA date Mar 26 2006 3:00 Oct 29 2006 3:00
aaa new-model
!
!
aaa authentication login default local
aaa authorization exec default local
aaa session-id common
ip subnet-zero
no ip source-route
!
!
ip tcp synwait-time 10
no ip domain lookup
ip domain name 
virgilio.it
ip name-server 62.211.69.150
ip name-server 81.29.198.123
!
no ip bootp server
ip cef
ip inspect audit-trail
ip inspect name CBAC_FIREWALL ftp
ip inspect name CBAC_FIREWALL icmp
ip inspect name CBAC_FIREWALL smtp
ip inspect name CBAC_FIREWALL tftp
ip inspect name CBAC_FIREWALL tcp
ip inspect name CBAC_FIREWALL udp
ip audit notify log
ip audit po max-events 100
vpdn enable
!
vpdn-group ppoe
!
no ftp-server write-enable
!
!
!
!
!
!
!
interface Null0
 no ip unreachables
!
interface ATM0
 no ip address
 no ip redirects
 no ip unreachables
 no ip proxy-arp
 ip route-cache flow
 no atm ilmi-keepalive
 bundle enable
 !
 dsl operating-mode auto
 hold-queue 224 in
!
interface ATM0.1 point-to-point
 no ip redirects
 no ip unreachables
 no ip proxy-arp
 pvc 8/35
  encapsulation aal5snap
  pppoe-client dial-pool-number 1
 !
!
interface FastEthernet0
 description int_interna
 ip address 192.168.1.1 255.255.255.0
 ip access-group 100 in
 no ip redirects
 no ip unreachables
 no ip proxy-arp
 ip nat inside
 ip route-cache flow
 ip tcp adjust-mss 1452
 speed auto
 no cdp enable
 hold-queue 100 out
!
interface Serial0
 bandwidth 56
 ip address 192.168.0.2 255.255.255.252
 no ip redirects
 no ip unreachables
 no ip proxy-arp
 ip nat inside
 encapsulation ppp
 ip route-cache flow
 shutdown
 no keepalive
 clockrate 56000
 no fair-queue
 ppp authentication chap
!
interface Dialer1
 description int_esterna
 mtu 1492
 ip address negotiated
 ip access-group 101 in
 no ip redirects
 no ip unreachables
 no ip proxy-arp
 ip nat outside
 ip inspect CBAC_FIREWALL out
 encapsulation ppp
 ip route-cache flow
 dialer pool 1
 dialer-group 1
 ntp disable
 ppp authentication pap callin
 ppp pap sent-username ****** password 7 070035444B01100B10
!
ip nat inside source list 1 interface Dialer1 overload
ip nat inside source static tcp 192.168.1.10 80 interface Dialer1 80
ip nat inside source static udp 192.168.1.4 4672 interface Dialer1 4672
ip nat inside source static tcp 192.168.1.4 4662 interface Dialer1 4662
ip nat inside source static tcp 192.168.1.4 4711 interface Dialer1 4711
ip nat inside source static tcp 192.168.1.4 6257 interface Dialer1 6257
ip nat inside source static udp 192.168.1.4 6257 interface Dialer1 6257
no ip classless
ip route 0.0.0.0 0.0.0.0 Dialer1
no ip http server
no ip http secure-server
!
!
logging trap debugging
logging 192.168.1.4
access-list 1 remark nat_inside_list
access-list 1 permit 192.168.1.0 0.0.0.255
access-list 3 remark HTTP Access-class list
access-list 3 permit 192.168.1.0 0.0.0.255
access-list 3 deny   any
access-list 100 remark firewall configuration
access-list 100 permit tcp any eq 4662 any
access-list 100 permit tcp any eq 4672 any
access-list 100 permit tcp any eq 4711 any
access-list 100 deny   ip host 255.255.255.255 any
access-list 100 deny   ip 127.0.0.0 0.255.255.255 any
access-list 100 permit ip any any
access-list 101 permit tcp any host 192.168.1.10 eq www
access-list 101 permit tcp any any eq 6257
access-list 101 permit tcp any any eq 4711
access-list 101 permit tcp any any eq 4662
access-list 101 permit udp any any eq 6257
access-list 101 permit udp any any eq 4672
access-list 101 permit udp host 62.211.69.150 eq domain any
access-list 101 permit udp host 81.29.198.123 eq domain any
access-list 101 permit icmp any any echo-reply
access-list 101 permit icmp any any time-exceeded
access-list 101 permit icmp any any unreachable
access-list 101 deny   ip 10.0.0.0 0.255.255.255 any
access-list 101 deny   ip 172.16.0.0 0.15.255.255 any
access-list 101 deny   ip 192.168.0.0 0.0.255.255 any
access-list 101 deny   ip 192.168.1.0 0.0.0.255 any
access-list 101 deny   ip 127.0.0.0 0.255.255.255 any
access-list 101 deny   ip host 255.255.255.255 any
access-list 101 deny   ip host 0.0.0.0 any
access-list 101 deny   ip any any log
no cdp run
!
tacacs-server host 192.168.1.10 single-connection
tacacs-server directed-request
tacacs-server key securekey
radius-server authorization permit missing Service-Type
banner login ^CSP network <access restricted only authorized personnel>^C
!
line con 0
 logging synchronous
line aux 0
line vty 0 4
 access-class 3 in
 password 7 0820484F1A0D1716020E1E05393B213A32
 transport input telnet ssh
!
scheduler max-task-time 5000
scheduler allocate 4000 1000
scheduler interval 500
!
end
---
Outgoing mail is certified Virus Free.
Checked by AVG anti-virus system (
http://www.grisoft.com
).
Version: 6.0.665 / Virus Database: 428 - Release Date: 21/04/2004



 access-list 101 permit tcp any host 192.168.1.10 eq www
Con questa ACL scritta così dichiari:
accetta tutte le connessioni verso la porta tcp 80, da qualunque 
ip_sorgente diretta verso l'ip 192.168.1.10.
ora dato che gli utenti devono accedere da internet, non può esserci un 
pacchetto che contiene destinazione l'ip 192.168.1.10, in quanto essendo 
un ip privato, i router li scartano facendo passare solo gli ip pubblici.
Cambia l'ACL sostituendo l'host 192.168.1.10 con any, dato che non hai 
ip statico
-- 
Alessandro Pensato,
AreaNetworking.it Staff
AreaNetworking Cisco Users Group
http://www.areanetworking.it/cug.php
mail: 
alessandr...@areanetworking.it
irc: irc.azzurra.org@#areanetworking
http://www.alessandro-pensato.it