Wednesday 26 September 2012

Setting up a Cisco Route-map - Local LAN Access on VPN

Setting up a Cisco Route-map - Local LAN Access on VPN I recently setup a Cisco VPN for me to access my server at home remotely this was great but i realized that when i was connected i could not get on to the server with RDP or VNC, i had already set these up from a external connection where the VPN wasnt accessible by putting in simple port forwarding rules.
What i wanted to achieve was to be connected to the VPN and use my services that i could do from my port forwarding rules.
I had to do the following to get this working.
Here are my original rules to allow access from external connections without the VPN.
ip nat inside source static tcp 192.168.2.120 5900 interface Dialer0 
ip nat inside source static tcp 192.168.2.120 5800 interface Dialer0
ip nat inside source static tcp 192.168.2.120 3389 interface Dialer0

I realized that these rules were not going to work whilst on the VPN because it was trying to route through the Dialer0 interface, i needed to setup a route-map, first things first i had to create a new ACL which i numbered 120, then permit the ip range my range for my VPN connection was 192.168.5.0 0.0.0.255 so the access-list would look like this,
access-list 120 permit ip 192.168.2.0 0.0.0.255 192.168.5.0 0.0.0.255

I then moved onto setting up the route-map i named it Bypass-NAT, type the following into your rotuer

route-map Bypass-NAT deny 10
match ip address 120
route-map Bypass-NAT permit 20

You can copy and paste these lines of code but only 1 line at a time, now that you have the ACL in place and also the route-map you will need to re write your rules for you port forwarding, so delete the old rules by typing the following,
no ip nat inside source static tcp 192.168.2.120 5900 interface Dialer0 
no ip nat inside source static tcp 192.168.2.120 5800 interface Dialer0
no ip nat inside source static tcp 192.168.2.120 3389 interface Dialer0

when you have done this write back your config then put in the new port forwarding rules like below

ip nat inside source static tcp 192.168.2.120 5800 YOUR.PUBLIC.IP 5800 route-map Bypass-NAT extendable
ip nat inside source static tcp 192.168.2.120 5900  YOUR.PUBLIC.IP  5900 route-map Bypass-NAT extendable
ip nat inside source static tcp 192.168.2.120 3389  YOUR.PUBLIC.IP 3389 route-map Bypass-NAT extendable

Once again write back your config and try to RDP from external and test, then connect your Cisco VPN Client and try to RDP to the private IP, everything should be working fine.


No comments:

Post a Comment