Eu estou finalmente tentando configurar um servidor VPN PPTP dentro do meu firewall, mas para verificar se o roteador será configurado corretamente primeiro, estou tentando passar o SSH através do Cisco 881 para o servidor SSH (10.10.100.20). Parece que minha configuração deve estar certa, mas não consigo SSH do meu VPS no Linode de volta à minha rede.
Eu excluí o modem, pois coloco meu laptop em nosso IP estático e consegui o SSH dele em meu Linode. Assim que o roteador estiver no caminho, não consigo acessar o SSH.
Aqui está minha configuração
!
! Last configuration change at 08:51:36 PCTime Wed Sep 22 2010 by admin
!
version 15.0
no service pad
service tcp-keepalives-in
service tcp-keepalives-out
service timestamps debug datetime msec localtime show-timezone
service timestamps log datetime msec localtime show-timezone
service password-encryption
service sequence-numbers
!
hostname router
!
boot-start-marker
boot-end-marker
!
security authentication failure rate 3 log
security passwords min-length 6
no logging buffered
no logging console
enable secret 5
!
no aaa new-model
memory-size iomem 10
clock timezone PCTime -5
clock summer-time PCTime date Apr 6 2003 2:00 Oct 26 2003 2:00
!
crypto pki trustpoint TP-self-signed-1169761916
enrollment selfsigned
subject-name cn=IOS-Self-Signed-Certificate-1169761916
revocation-check none
rsakeypair TP-self-signed-1169761916
!
!
crypto pki certificate chain TP-self-signed-1169761916
certificate self-signed 01
quit
no ip source-route
!
!
ip dhcp excluded-address 10.0.0.1
ip dhcp excluded-address 10.100.0.1 10.100.10.0
ip dhcp excluded-address 10.100.10.255 10.100.255.254
ip dhcp excluded-address 10.10.100.1 10.10.100.40
ip dhcp excluded-address 10.10.100.150 10.10.100.250
!
ip dhcp pool ccp-pool1
import all
network 10.10.10.0 255.255.255.0
dns-server #DNS# #DNS#
default-router 10.10.10.1
!
ip dhcp pool gpool
import all
network 10.100.10.0 255.255.255.0
dns-server #DNS# #DNS#
default-router 10.100.10.1
!
ip dhcp pool wpool
import all
network 10.10.100.0 255.255.255.0
dns-server #DNS# #DNS#
default-router 10.10.100.1
!
ip dhcp pool wgroup
origin file wgroup.txt
!
!
ip cef
no ip bootp server
no ip domain lookup
ip domain name viridianspark.com
ip name-server #DNS#
ip name-server #DNS#
no ipv6 cef
!
!
license udi pid CISCO881W-GN-A-K9 sn FTX143081B2
license agent notify http://192.168.56.1:9710/clm/servlet/HttpListenServlet dummy dummy 2.0
!
!
username admin privilege 15 secret 5
!
!
ip tcp synwait-time 10
ip ssh time-out 60
ip ssh authentication-retries 2
!
class-map type inspect match-any ccp-cls-insp-traffic
match protocol cuseeme
match protocol dns
match protocol ftp
match protocol h323
match protocol https
match protocol icmp
match protocol imap
match protocol pop3
match protocol netshow
match protocol shell
match protocol realmedia
match protocol rtsp
match protocol smtp
match protocol sql-net
match protocol streamworks
match protocol tftp
match protocol vdolive
match protocol tcp
match protocol udp
class-map type inspect match-all ccp-insp-traffic
match class-map ccp-cls-insp-traffic
class-map type inspect match-any ccp-cls-icmp-access
match protocol icmp
match protocol tcp
match protocol udp
class-map type inspect match-all ccp-invalid-src
match access-group 100
class-map type inspect match-all ccp-icmp-access
match class-map ccp-cls-icmp-access
class-map type inspect match-all ccp-protocol-http
match protocol http
!
!
policy-map type inspect ccp-permit-icmpreply
class type inspect ccp-icmp-access
inspect
class class-default
pass
policy-map type inspect ccp-inspect
class type inspect ccp-invalid-src
drop log
class type inspect ccp-protocol-http
inspect
class type inspect ccp-insp-traffic
inspect
class class-default
drop
policy-map type inspect ccp-permit
class class-default
drop
!
zone security out-zone
zone security in-zone
zone-pair security ccp-zp-self-out source self destination out-zone
service-policy type inspect ccp-permit-icmpreply
zone-pair security ccp-zp-in-out source in-zone destination out-zone
service-policy type inspect ccp-inspect
zone-pair security ccp-zp-out-self source out-zone destination self
service-policy type inspect ccp-permit
!
!
!
!
!
!
!
interface FastEthernet0
switchport access vlan 2
!
interface FastEthernet1
switchport access vlan 2
!
interface FastEthernet2
switchport access vlan 2
!
interface FastEthernet3
switchport access vlan 2
!
interface FastEthernet4
description $ES_WAN$$FW_OUTSIDE$$ETH-WAN$
ip address #EXTERNAL_IP# 255.255.255.252
ip access-group VPN in
no ip redirects
no ip unreachables
no ip proxy-arp
ip nat outside
ip virtual-reassembly
zone-member security out-zone
duplex auto
speed auto
!
interface wlan-ap0
description Service module interface to manage the embedded AP
ip unnumbered Vlan1
no ip redirects
no ip unreachables
no ip proxy-arp
ip flow ingress
arp timeout 0
!
interface Wlan-GigabitEthernet0
description Internal switch interface connecting to the embedded AP
switchport mode trunk
!
interface Vlan1
description $ETH-SW-LAUNCH$$INTF-INFO-HWIC 4ESW$$ES_LAN$$FW_INSIDE$
ip address 10.10.10.1 255.255.255.0
no ip redirects
no ip unreachables
no ip proxy-arp
ip flow ingress
ip nat inside
ip virtual-reassembly
zone-member security in-zone
ip tcp adjust-mss 1452
!
interface Vlan2
ip address 10.10.100.1 255.255.255.0
ip access-group 102 in
ip helper-address 10.10.100.104
no ip redirects
no ip unreachables
no ip proxy-arp
ip flow ingress
ip nat inside
ip virtual-reassembly
zone-member security in-zone
!
interface Vlan3
ip address 10.100.10.1 255.255.255.0
ip access-group 101 in
no ip redirects
no ip unreachables
no ip proxy-arp
ip flow ingress
ip nat inside
ip virtual-reassembly
zone-member security in-zone
!
ip forward-protocol nd
ip http server
ip http authentication local
ip http secure-server
ip http timeout-policy idle 60 life 86400 requests 10000
!
ip nat inside source list 2 interface FastEthernet4 overload
ip nat inside source list 3 interface FastEthernet4 overload
ip nat inside source list 4 interface FastEthernet4 overload
ip nat inside source static tcp 10.10.100.20 22 #EXTERNAL_IP# 22 extendable
ip route 0.0.0.0 0.0.0.0 #EXTERNAL_GATEWAY#
!
ip access-list extended VPN
permit gre any host 10.10.100.20
permit tcp any host 10.10.100.20 eq 22
permit ip 10.0.0.0 0.255.255.255 any
permit ip any any
permit icmp any any
ip access-list extended vpn
permit ip 10.0.0.0 0.255.255.255 any
!
logging trap debugging
logging 10.10.100.22
access-list 1 remark INSIDE_IF=Vlan1
access-list 1 remark CCP_ACL Category=2
access-list 1 permit 10.10.10.0 0.0.0.255
access-list 2 remark CCP_ACL Category=2
access-list 2 permit 10.10.10.0 0.0.0.255
access-list 3 remark CCP_ACL Category=2
access-list 3 permit 10.10.100.0 0.0.0.255
access-list 4 remark CCP_ACL Category=2
access-list 4 permit 10.100.10.0 0.0.0.255
access-list 101 permit ip 10.100.10.0 0.0.0.255 10.100.10.0 0.0.0.255
access-list 101 deny icmp 10.100.10.0 0.0.0.255 10.10.100.0 0.0.0.255
access-list 101 deny ip 10.100.10.0 0.0.0.255 10.10.100.0 0.0.0.255
access-list 101 permit ip 10.100.10.0 0.0.0.255 any
access-list 101 permit udp any any eq bootpc
access-list 101 permit udp any any eq bootps
access-list 102 permit ip 10.10.100.0 0.0.0.255 10.10.100.0 0.0.0.255
access-list 102 permit ip 10.10.100.0 0.0.0.255 any
access-list 102 permit udp any any eq bootpc
access-list 102 permit udp any any eq bootps
no cdp run
!
!
!
!
!
control-plane
!
banner exec ^CCC
Welcome to the jungle.
^C
banner login ^CCCIf a router goes down and no one is around to browse the internet, did it drop any packets
^C
!
line con 0
login local
no modem enable
transport output telnet
line aux 0
login local
transport output telnet
line 2
no activation-character
no exec
transport preferred none
transport input all
line vty 0 4
privilege level 15
login local
transport input telnet ssh
!
scheduler max-task-time 5000
scheduler allocate 4000 1000
scheduler interval 500
end
Não parece que você tenha uma configuração de zona de segurança para o tráfego de 'saída' para 'entrada'. Você pode precisar de algo assim:
!
class-map type inspect match-any ccp-ssh
match protocol ssh
!
policy-map type inspect ccp-permit-ssh
class type inspect ccp-ssh
inspect
!
zone-pair security ccp-zp-out-in source out-zone destination in-zone
service-policy type inspect ccp-permit-ssh
Tente encaminhar de uma porta externa diferente (2222 por exemplo) para a porta 22 no IP local. Atualmente, você tem o SSH ativado para a Cisco, o que causaria alguns problemas.
Passos para solução de problemas do casal:
Eu tiraria todas as ACLs (remova as instruções do grupo de acesso ip) para ter certeza. Suas declarações NAT parecem certas para mim, mas garanta que você possa vê-las com show ip nat translations .
Além disso, lembre-se de que as ACLs são pré-natais de acordo com a ordem de operações NAT então você precisaria que sua regra ssh na interface externa fosse para o IP público.