Unable to telnet to port 80 on server in DMZ

Question

I have a Cisco RV325 router. I'm not able to telnet to port 80 for the server on the DMZ port.

Why can't I telnet to port 80 ?

Here is what I've done:

• Connect IIS server to DMZ port
  • This server has an internal static IP of 192.168.3.70
  • Turned off Windows Firewall
• Connect other LAN computers to LAN ports
  • These computers are on the 192.168.3.X subnet

• Assigned one external static IP to WAN1, and a second external IP to the DMZ

• Added access rules to allow HTTP and HTTPS, and deny all other traffic on the DMZ port.

According to Cisco:

Keep in mind that access rules are ordered. That is, when the device compares a packet against the rules, it searches from top to bottom and applies the policy for the first rule that matches it, and ignores all subsequent rules

NOTE: The access rules without a priority are the ones created by the router, by default.

I then attempted to telnet from an external computer (a computer outside the network) to port 80 of the external IP assigned to the DMZ, and it fails. For good measure, I also attempted to telnet to port 21, and it also fails.

But the router log shows :

I don't understand why I'm seeing ALLOW for the telnet attempt on port 21. And I don't understand why my telnet to port 80 isn't working.

In the end, I just want to be able to telnet to port 80.

Answer 1

I've finally figured this out by piecing together information from two other sources.

First, the post from Sleeman here states:

Let's say your ISP gives you aaa.bbb.ccc.192 - 195 with a subnet of 255.255.255.252.

This means all IP's in that range have the same subnet AND. . .

.192 is the 'network' address. .193 is the 'gateway' address **this is the address you use in the 'setup' page of the RV042. .194 is the only usable public IP in the DMZ. .195 is the 'broadcast' address.

If you get a .248 block with a .192 network, then you end up with 5 usuable IP's in the DMZ (you need to run the DMZ port through a switch to use all more than 1 IP).

That made me realize that I have the wrong external IP address assigned to the DMZ port. My ISP assigned addresses x.x.x.17 - 22, with subnet 255.255.255.248. I had assigned x.x.x.17 to the DMZ port, and x.x.x.18 to the WAN1 port.

The symptom of this problem was pointed out above in comments: The WAN1 access rule showed a RANGE as the Destination.

So I changed the DMZ port configuration to use x.x.x.20. Since at IP address and the one for WAN1 are on the same subnet, I also changed the DMZ port from "Subnet" to "Range".

The second part of the solution was the IP address configuration on the IIS server itself. I read this solution for another router in the RV series, which said:

Then, on the server you would put in the IP address that it will be (public one that you entered above), for the subnet mask you would use what your DataCenter gave you...and for the Gateway you would put the same IP that the datacenter gave you.

So I changed the IP address on the IIS server to x.x.x.20, and set the Gateway to the Gateway assigned by my ISP (which is also the same Gateway for WAN1).

This worked. I'm now able to telnet to port 80 from the outside world.