Security

Ask something
Discussion Locked

any access-list gurus out here?

0 helpful
5 replies

by axekick

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.

Hey all, I need a little help setting up an access list on my cisco router. (I'm a rookie at this)

Basically I want to allow all traffic on my network out into the internet but deny any attempts from the outside world to contact my router.I thought something like:
access-list 102 permit tcp 0.0.0.0 255.255.255.255 eq www
access-list 102 deny any

applied to the "in" part of my connection to the internet would allow www traffic through but it's not :-( ie when I tryto surf with that access-grou in place I go nowhere.

Thanks a bunch in advance! :-)

5 replies

by rmartin

What interfaces are connected to your router? For ex. does the internet connect to Serial 0, and your LAN connect to Ethernet 0? Do you have a static public address from your ISP assigned to Serial 0?
Is this a new install that can not currently connect? This is really a two step process. First is to setup and allow inbound traffic out, then setup another access list to deny inbound. If you have your LAN is connected as described above, you will need to do PAT to browse the internet.

by axekick

I'm running PAT on my E1 interface. Static IP from my isp. I've got the box working fine when no access list is applied to the interface, ie I can surf do email, quake, all that... The problem occurs when I try to harden that interface from the outside world. When I apply the above access-list I can't do *anything* outside my network. :-(
Basically I need help with te syntax ad concepts behind denying outside access while still allowing traffic from the inside to go unhindered. (Without buying a book...I'm poor ;-) )

by rmartin

Try this:

access-list 101 permit tcp any any established
access-list 101 permit tcp any eq domain any
access-list 101 permit udp any eq domain any
access-list 101 permit tcp any eq ftp-data any
access-list 101 deny ip any any log

This should allow you to browse the internet, and FTP files IN. You will not be able to get icmp echo-reply when ping an internet address, and nobody will get a reply when they ping your router. If you want to be able to ping out to the internet, add the following line:

access-list 101 permit icmp any any echo-reply

Good Luck! Access list can be a real treat!

This discussion is closed to new replies.