0

I have a Cisco RV325 router. I'm not able to telnet to port 80 for the server on the DMZ port.

Why can't I telnet to port 80 ?

Here is what I've done:

  • Connect IIS server to DMZ port
    • This server has an internal static IP of 192.168.3.70
    • Turned off Windows Firewall
  • Connect other LAN computers to LAN ports
    • These computers are on the 192.168.3.X subnet
  • Assigned one external static IP to WAN1, and a second external IP to the DMZ DMZ

  • Added access rules to allow HTTP and HTTPS, and deny all other traffic on the DMZ port.

access rules

According to Cisco:

Keep in mind that access rules are ordered. That is, when the device compares a packet against the rules, it searches from top to bottom and applies the policy for the first rule that matches it, and ignores all subsequent rules

NOTE: The access rules without a priority are the ones created by the router, by default.

I then attempted to telnet from an external computer (a computer outside the network) to port 80 of the external IP assigned to the DMZ, and it fails. For good measure, I also attempted to telnet to port 21, and it also fails.

But the router log shows :

log

I don't understand why I'm seeing ALLOW for the telnet attempt on port 21. And I don't understand why my telnet to port 80 isn't working.

In the end, I just want to be able to telnet to port 80.

  • Are you sure that should be the external IP address range? The RV320/RV325 manual (pages 31 and 34 in the Administration Guide) seems suspiciously unclear on this. You might want to turn on logging of rejected traffic; that could provide clues as to what is going on. – a CVn Jun 30 '17 at 20:06
  • @MichaelKjörling : I have the rejected traffic logging enabled (yet everything in the log shows ALLOW). The external IP range that's showing up in that access rule was done automatically by the router, in response to my WAN1 config. In the config, I input one of the external static IP addresses, along with the subnet 255.255.255.248. Should I change that subnet to something else ? We have a range of several static IP addresses assigned to us by the ISP. If it matters, ping of the WAN1 IP fails, which is what I expect. – devlin carnate Jun 30 '17 at 21:11
0

I've finally figured this out by piecing together information from two other sources.

First, the post from Sleeman here states:

Let's say your ISP gives you aaa.bbb.ccc.192 - 195 with a subnet of 255.255.255.252.

This means all IP's in that range have the same subnet AND. . .

.192 is the 'network' address. .193 is the 'gateway' address **this is the address you use in the 'setup' page of the RV042. .194 is the only usable public IP in the DMZ. .195 is the 'broadcast' address.

If you get a .248 block with a .192 network, then you end up with 5 usuable IP's in the DMZ (you need to run the DMZ port through a switch to use all more than 1 IP).

That made me realize that I have the wrong external IP address assigned to the DMZ port. My ISP assigned addresses x.x.x.17 - 22, with subnet 255.255.255.248. I had assigned x.x.x.17 to the DMZ port, and x.x.x.18 to the WAN1 port.

The symptom of this problem was pointed out above in comments: The WAN1 access rule showed a RANGE as the Destination.

So I changed the DMZ port configuration to use x.x.x.20. Since at IP address and the one for WAN1 are on the same subnet, I also changed the DMZ port from "Subnet" to "Range".

The second part of the solution was the IP address configuration on the IIS server itself. I read this solution for another router in the RV series, which said:

Then, on the server you would put in the IP address that it will be (public one that you entered above), for the subnet mask you would use what your DataCenter gave you...and for the Gateway you would put the same IP that the datacenter gave you.

So I changed the IP address on the IIS server to x.x.x.20, and set the Gateway to the Gateway assigned by my ISP (which is also the same Gateway for WAN1).

This worked. I'm now able to telnet to port 80 from the outside world.

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.