AIUTO CONFICURAZIONE 1700 CON 2 ETH

[GEOENTECH]

Ho esigenze di usare un router serie 1700 per filtrare tutto il traffico che passa ed ovviamente usare il router come gateway. tutti i client collegati sono in dhcp.
Il router su interfaccia FastEthrnet0 ( Fisica del router) ha un ip pubblico,
l'interfaccia Ethernet0 (Wic aggiunta) ha un indirizzo 10.39.5.X

Allego configurazione che mi sono inprovvisato!


Current configuration : 2835 bytes
!
version 12.2
service timestamps debug datetime msec
service timestamps log datetime msec
no service password-encryption
!
hostname GEOENTECH_CASAREGIS
!
!
username Router password 0 xxxxxxxxx
clock summer-time gmt+1 recurring
ip subnet-zero
ip name-server 151.99.125.2
ip name-server 151.99.125.1
ip dhcp excluded-address 10.39.7.145
!
ip dhcp pool 1
network 10.39.7.0 255.255.255.0
default-router 10.39.7.145
dns-server 151.99.125.2
domain-name geoentech.com
!
ip inspect name ethernetin cuseeme timeout 3600
ip inspect name ethernetin ftp timeout 3600
ip inspect name ethernetin h323 timeout 3600
ip inspect name ethernetin http timeout 3600
ip inspect name ethernetin rcmd timeout 3600
ip inspect name ethernetin realaudio timeout 3600
ip inspect name ethernetin smtp timeout 3600
ip inspect name ethernetin sqlnet timeout 3600
ip inspect name ethernetin streamworks timeout 3600
ip inspect name ethernetin tcp timeout 3600
ip inspect name ethernetin tftp timeout 30
ip inspect name ethernetin udp timeout 15
ip inspect name ethernetin vdolive timeout 3600
ip audit notify log
ip audit po max-events 100
!
interface Loopback0
no ip address
!
ip address dhcp
ip access-group 101 in
no ip redirects
no ip unreachables
no ip proxy-arp
ip nat inside
ip inspect ethernetin in
ip tcp adjust-mss 1452
half-duplex
no cdp enable
hold-queue 100 out
!
interface FastEthernet0
ip address 82.90.xx.xx 255.255.255.248
ip access-group 112 in
ip access-group 105 out
ip nat outside
speed auto
!
ip default-gateway 82.90.xx.xx
ip nat pool mypool 82.90.xx.xx (primo ip pubblico) 82.90.xx.xx (ultimo ip pubblico) netmask 255.255.255.248
ip nat inside source list 1 interface FastEthernet0 overload
ip classless
ip route 0.0.0.0 0.0.0.0 Ethernet0
ip route 0.0.0.0 0.0.0.0 FastEthernet0
ip route 0.0.0.0 0.0.0.0 82.90.xx.xx
no ip http server
!
!
access-list 1 permit any
access-list 1 permit 10.0.0.0 0.255.255.255
access-list 101 permit tcp 10.0.0.0 0.255.255.255 any
access-list 101 permit tcp 20.0.0.0 0.255.255.255 any
access-list 101 permit udp 10.0.0.0 0.255.255.255 any
access-list 101 permit icmp 10.0.0.0 0.255.255.255 any
access-list 101 deny ip any any log
access-list 105 permit ip any any
access-list 112 permit icmp any 82.90.xx.0 0.0.0.255 unreachable
access-list 112 permit icmp any 82.90.xx.0 0.0.0.255 echo-reply
access-list 112 permit icmp any 82.90.xx.0 0.0.0.255 packet-too-big
access-list 112 permit icmp any 82.90.xx.0 0.0.0.255 time-exceeded
access-list 112 permit icmp any 82.90.xx.0 0.0.0.255 traceroute
access-list 112 permit icmp any 82.90.xx.0 0.0.0.255 administratively-prohibit
access-list 112 deny ip any any log
!
line con 0
line aux 0
line vty 0 4
login
!
end

[TheIrish]

Sì ma... non ci hai detto cosa vuoi che faccia...

[GEOENTECH]

Le caratteristiche della configurazione :

FASTethernet0 rete pubblica con ip pubblico
Ethernet 0 rete interna con ip privato

il router oltre che farmi un snoffing del traffico avrei l'esigenza che mi filtrasse in modo da impedire attacchi esterni sulla rete

Al momento ho un router alice, il cisco deve stare tra il router alice e il server w2000server che mi fa da dhcp, condivisione internet ed altri servizi.

Ovviamente il server w2ks deve essere accessibile dall'esterno.

AVETE CONSIGLI DA DARMI ????????