Есть конфига... Простая сеть, плюс ВПН тунели. Из под ВПН, внутри сети RDP на адресс 192,168,5,112 идет нормально...
Но из внешки - по не понятной мне причине оно тупо не проходит.
Вот что говорит show когда пытаюсь подключиться из дому:
Router0(config)#do show ip nat translations | include 3389
tcp ххх.28.110.78:3389 192.168.5.112:3389 zzz.154.99.159:51798 zzz.154.99.159:51798
Предполагаю что пакет где то на выходе vlan1 умирает...
Собственно сама конфига
Router0(config)#do sh run
Building configuration...
Current configuration : 3607 bytes
!
! Last configuration change at 21:56:34 Russian Sat Aug 30 2014 by enginee
version 15.3
no service pad
service timestamps debug datetime msec
service timestamps log datetime msec
service password-encryption
!
hostname Router0
!
boot-start-marker
boot-end-marker
!
!
!
aaa new-model
!
!
aaa authentication login default local
aaa authentication ppp default local
aaa authorization network default local
!
!
!
!
!
aaa session-id common
memory-size iomem 10
clock timezone Russian 10 0
!
!
!
ip dhcp excluded-address 192.168.5.1
ip dhcp excluded-address 192.168.5.1 192.168.5.20
ip dhcp excluded-address 192.168.5.50
ip dhcp excluded-address 192.168.5.111
ip dhcp excluded-address 192.168.5.112
!
ip dhcp pool LAN
network 192.168.5.0 255.255.255.0
default-router 192.168.5.1
dns-server 192.168.5.1
!
!
!
ip domain name cisco
ip name-server 81.17.2.171
ip inspect name INSPECT_OUT dns
ip inspect name INSPECT_OUT icmp router-traffic
ip inspect name INSPECT_OUT ntp
ip inspect name INSPECT_OUT tcp router-traffic
ip inspect name INSPECT_OUT udp router-traffic
ip inspect name INSPECT_OUT http
ip inspect name INSPECT_OUT https
ip inspect name INSPECT_OUT ftp
ip inspect name INSPECT_OUT sip
ip inspect name INSPECT_OUT router
ip inspect name INSPECT_OUT smtp
ip inspect name INSPECT_OUT pptp
ip cef
no ipv6 cef
!
!
vpdn enable
!
vpdn-group ZENIT
! Default PPTP VPDN group
accept-dialin
protocol pptp
virtual-template 1
!
!
!
license udi pid CISCO881-K9 sn ---
!
!
archive
log config
logging enable
hidekeys
username admin privilege 5 secret 5 --------
!
!
ip ssh time-out 60
ip ssh authentication-retries 2
ip ssh version 2
!
!
!
!
interface Loopback0
no ip address
!
interface FastEthernet0
no ip address
!
interface FastEthernet1
no ip address
!
interface FastEthernet2
no ip address
!
interface FastEthernet3
no ip address
!
interface FastEthernet4
description ==INTERNET==
ip address xx.28.110.78 255.255.255.252
ip access-group FIREWALL in
no ip redirects
no ip proxy-arp
ip nat outside
ip inspect INSPECT_OUT out
ip virtual-reassembly in
ip verify unicast reverse-path
duplex auto
speed auto
no cdp enable
!
interface Virtual-Template1
ip unnumbered Vlan1
peer default ip address pool ZENIT
no keepalive
ppp authentication pap
!
interface Vlan1
description ==LAN==
ip address 192.168.5.1 255.255.255.0
ip access-group FIREWALL_OUT in
ip accounting output-packets
ip nat inside
ip virtual-reassembly in
!
ip local pool ZENIT 192.168.5.200 192.168.5.250
ip forward-protocol nd
no ip http server
no ip http secure-server
!
ip dns server
ip nat inside source list NAT_ACL interface FastEthernet4 overload
ip nat inside source static tcp 192.168.5.112 3389 interface FastEthernet4 3389
ip nat inside source static tcp 192.168.5.112 4888 interface FastEthernet4 4888
ip route 0.0.0.0 0.0.0.0 xx.28.110.77
!
ip access-list extended FIREWALL
permit tcp any any eq 22
permit tcp any any eq 4888
permit tcp any any eq 3389
permit tcp any host xx.28.110.78 eq 3389
permit icmp any any
permit tcp any any eq 1723
permit gre any any
ip access-list extended FIREWALL_DENY
ip access-list extended FIREWALL_OUT
permit ip any any
ip access-list extended NAT
ip access-list extended NAT_ACL
permit ip 192.168.5.0 0.0.0.255 any
!
!
!
!
!
!
line con 0
no modem enable
line aux 0
line vty 0 4
privilege level 15
transport input telnet ssh
!
!
end
Сложный
Сложный
