【Typical Case】How to Configure Port Mapping to Allow a Designated Extranet User to Access a Specified Intranet Device？

1. Configuration Requirements

There is a CCTV camera on the intranet of a Reyee EG router with port mapping configured for this camera. To ensure security, the customer wants to allow access to the camera for a specific external user through the port mapping policy.
2. Device Model and Firmware

Device Type	Device Model	Firmware Version
Reyee EG	EG305GH-P-E	ReyeeOS 2.283.0.1904

3. Configuration Notes

• Configure port mapping on the EG router.
• Specify the public IP address of the designated extranet user.
• Configure ACLs.
  

4. Solution

Note:This section explains how to configure port mapping to allow an external user to access an AP on the intranet of the EG router.
4.1 Configuring Port Mapping on the EG Router
IP address of intranet device: 192.168.110.4
Choose Gateway> Advanced > Port Mapping.



Perform an access test:
Port mapping functions properly.

4.2 Specifyingthe Public IP Address of the Extranet User

Visit https://whatismyipaddress.com/ to find the public IP address of the network where the extranet user is located.
4.3 Configuring ACLs

Configure an ACL to deny all accesses to the LANIP address in the port mapping policy.
Note: If the destination address in the ACL is the WAN port address of the EG router, this requirement cannot be implemented. This is because data entering the WAN port from an extranet under goes NAT before the ACL is applied. Therefore, in this case, the destination address in the ACL configuration must be the LAN IP address.
In this example, the IP address of the intranet device is 192.168.110.4, and the destination port is TCP 80.



Next, configure an ACL to only allow accessfrom the public IP address in 4.2.


Note: After configuration, ensure that the Allow rule has a higher priority than the Block rule. If necessary, click the Match Order column to adjust the order, as rules higher up have greater priority.

5. Verification
Test the configuration on a PC on the network that has the public IP address 112.x.x.x.

Access successful:

Test the configuration on a PC on the networkthat has the public IP address is 2xx.xxx.xxx.xxx.

Access failed: