How to Configure Port Mapping to Allow a Designated Extranet User to Access a Specified Intranet Device

1. Configuration Requirements

There is a CCTV camera on the intranet of a Reyee EG router with port mapping configured for this camera. To ensure security, the customer wants to allow access to the camera for a specific external user through the port mapping policy.

 
2. Device Model and Firmware

3. Configuration Notes

•    Configure port ma

12132132

pping on the EG router.

•    Specify the public IP address of the designated extranet user.

•    Configure ACLs.

4. Solution
Note: This section explains how to configure port mapping to allow an external user to access an AP on the intranet of the EG router.

4.1 Configuring Port Mapping on the EG Router

IP address of intranet device: 192.168.110.4

Choose Gateway > Advanced > Port Mapping.

Perform an access test:

Port mapping functions properly.

 
4.2 Specifying the Public IP Address of the Extranet User

Visit https://whatismyipaddress.com/ to find the public IP address of the network where the extranet user is located.

4.3 Configuring ACLs

•    Configure an ACL to deny all accesses to the LAN IP address in the port mapping policy.

Note: If the destination address in the ACL is the WAN port address of the EG router, this requirement cannot be implemented. This is because data entering the WAN port from an extranet undergoes NAT before the ACL is applied. Therefore, in this case, the destination address in the ACL configuration must be the LAN IP address.

In this example, the IP address of the intranet device is 192.168.110.4, and the destination port is TCP 80.

•    Next, configure an ACL to only allow access from the public IP address in 4.2.

Note: After configuration, ensure that the Allow rule has a higher priority than the Block rule. If necessary, click the Match Order column to adjust the order, as rules higher up have greater priority.
 

4.4 Test

•    Test the configuration on a PC on the network that has the public IP address 112.x.x.x.

Access successful:

•    Test the configuration on a PC on the network that has the public IP address is 2xx.xxx.xxx.xxx.

Access failed: