I cannot telnet to my Ethernet0 interface from the outside. Ethernet0 is my WAN interface, and Ethernet1 is my LAN interface which is doing NAT. I am able to telnet to the module from the LAN side, using the LAN IP. I have written an access-list that permits incoming telnet from the outside from a certain subnet. When a telnet connection is attempted from a permitted IP, the counter on the rule increments, but I do not get a login screen. Here is what I have configured for terminal access: line con 0 line vty 0 3 password 7 105D5D5D24444012 login line vty 4 login ! end

can you do a show run and type in the ACLs here it sounds like you didn't config ACL properly

Here it is. access-list 150 permit icmp 12.175.125.0 0.0.0.127 any echo access-list 150 permit icmp 156.12.0.0 0.0.255.255 any echo access-list 150 deny icmp any any echo access-list 150 permit tcp host 12.175.125.2 any eq telnet access-list 150 permit tcp host 12.175.125.3 any eq telnet access-list 150 permit tcp 156.12.0.0 0.0.255.255 any eq telnet access-list 150 permit tcp 12.175.125.0 0.0.0.127 any eq 48294 access-list 150 permit tcp 156.12.0.0 0.0.255.255 any eq 48294 access-list 150 deny tcp any any eq 48294 access-list 150 deny 53 any any access-list 150 deny 55 any any access-list 150 deny 77 any any access-list 150 deny 103 any any access-list 150 deny tcp any any eq telnet access-list 150 deny udp any any range 135 netbios-ss access-list 150 deny udp any any range 1433 1434 access-list 150 deny udp any any eq 443 access-list 150 deny udp any any eq 445 access-list 150 permit udp any any access-list 150 deny tcp any any range 135 139 access-list 150 deny tcp any any range 1433 1434 access-list 150 deny tcp any any eq 1080 access-list 150 deny tcp any any eq 8080 access-list 150 deny tcp any any eq 3120 access-list 150 deny tcp any any eq smtp access-list 150 permit ip any any

ok i automatically assumes you are using private ip address inside your network, right? what kind the NAT are we talking about here? port address translation, static, or dynamic NAT? lets just say if thats the case, then you will have to configure your NAT to translate correct me if i am wrong, i am not very good at this

I don't see what NAT has to do with it. I do not need to traverse the NAT to telnet to a machine on the local LAN. All I need to do is telnet to the unit's WAN port, Ethernet0, which has a public routable IP address. Like I said before, the ACL for telnet permissions seem to work correctly, because the appropriate rule counters increment when I attempt connections. So the TCP connection is established on TCP:23, it just seems as if the Cisco is not returning anything. I sniffed traffic and the Cisco is indeed not sending back any ACKs.

sorry for making this unclear the reason why telnet work isnide your LAN is 1: you are using private ip addressing 2: NAT has not effect inside the LAN you know what is "inside local", "inside global " and "outside global" is right?? 12.175.125.2, 12.175.125.3, 156.12.0.0, those ip addresses are going to be the outside global ip address, that is, routable addresses lets say when 12.175.125.2 trying to telnet into the router, your predefined ACL will increment 1, but you will not get a telnet screen becasue of NAT let me explain this, lets assume you got 10.10.10.1 for your E1, and 200.2.2.17 for your E0, when the telnet comes in, your acl will act, but router will not send any response becasue 10.10.10.1 will not be able to translate into inside global ip address, and therefore it will not be routed.

lets try this lets assume your router is named LAN go into conf t first so it will be like this lan(config)#access-list 1 permit 10.10.10.0 0.0.0.255 lan(config)#ip nat inside source list 1 interface e0 overload now you have to specify the interfaces lan(config)#interface ethernet 1 lan(config-if)#ip nat inside lan(config-if)#interface e0 lan(config-if)#ip nat outside "the reason why telnet work isnide your LAN is 1: you are using private ip addressing 2: NAT has not effect inside the LAN" let me clarify that statement, i didn't make it clear. NAT has no effect inside LAN because its not going to be routed out your E0 interface, NAT doesn't care whats going on inside your LAN, it only cares about the packet being send out and translates that address into public recognizable address