Access-List for pix 515

[bobo0605]

Hi, I'm trying to create an access-list to prevent some workstations from getting to the internet. Everytime i create a list it knocks everyone off the internet. Here;s my current configuration:

Access-list 110 deny tcp host 192.168.#.# eq www
Access-list 110 permit tcp any any eq www
Access-group 110 in interface inside

Any ideas would be appreciated!!!

 

[bell1996]

Have you tried:

access-list 110 deny tcp host 192.168.x.x any eq www
access-list 110 permit tcp any any eq www

access-group 110 in interface inside

Now you've got to be careful. What you've essentially done is ONLY permit port 80 for inside users to access the internet (minus the one user with the first deny). If anyone is using a TCP other than port 80, they will be denied. At the end of every cisco access list is an explicit DENY. It's not shown but it's there by default. So actually your access-list reads:

access-list 110 deny tcp host 192.168.x.x any eq www
access-list 110 permit tcp any any eq www
access-list 110 deny ip any any (explicit deny all)

access-group 110 in interface inside

hope this helps.

 

[bell1996]

Just to add to my first reply:

You may want to adjust you access-list to read like this:

access-list 110 deny ip host 192.168.x.x any
access-list 110 permit ip any any

access-group 110 in interface inside

This way you deny all traffic for the single host and permit all traffic for all others.

Hope this helps

 

[baddos]

Are your DNS servers allow udp 53? I don't see it on your access-list.

I wouldn't permit ip any any, but this list will probably be good for you.

access-list 110 deny tcp host 192.168.x.x any eq www
access-list 110 permit tcp any any eq www
access-list 110 permit tcp any any eq 443
access-list 110 permit tcp any any eq 20
access-list 110 permit tcp any any eq 21
access-list 110 permit udp any any eq 53
access-list 110 permit tcp host xxx.xxx.xxx.xxx any eq smtp
!replace xxx.xxx.xxx.xxx with your email server

access-group 110 in interface inside

 

[bobo0605]

Thanks! For the input. I will give these configurations a try and let you know how they go.

 

[71234]

i have an application which uses smtp to send emails. I want that to be blocked by the firewall ( PIX 501 ) only for that particular public ip 216.181.x.x which is mapped to an internal ip 192.168.x.x.

Thanks
Mathew

 

[baddos]

Blocked inbound or outbound?

 

[71234]

i want to block all emails which is generated from this application , from only 216.181.x.x not to go out of the firewall.