ACL Help

[onyx4000]

Hi, can anyone provide a sample access-list config allowing only certain ports (80,25, etc...) to be "open" to the public Internet and everything else is denied? I have tried for awhile but no luck, this is not making any sense to me. As soon as I implement this, port 80 is blocked b/c I can't browse the internet. Help, thanks a lot.

ACL config:

ip access-list 110 permit tcp any host 65.64.52.x eq 80
ip access-list 110 permit tcp any host 65.64.52.x eq 25
//(implicit deny all)
//65.64.52.x is my external address that is one-to-one NATed to a private address hosting these services.

WAN Interface ACL config:

ip access-group 110 in

 

[BOJIKA]

You forgot about DNS!!
permit DNS port tcp udp 53

 

[onyx4000]

Yeah, you're right, I forgot about it in my post, but I did try that, I also tried accessing a website via the IP but still no luck, I think it might have something to do with NAT?

 

[marsd]

Umm, you need high ports allowed (1024+) to connect to external web servers.
Client connect outbound:1926 -> server:80
server:80 inbound -> client:1926
unless your nat is misconfigured you should have no problem with this.

 

[yizhar]

HI!

You'll have to allow the return traffic to pass through the router.
If an inside client try to access a web-server in the Internet, your ACL will block the return packets from the web-server to the client.
You have some solutions for this:

* Use a dedicated firewall to filter traffic.
* Add IOS FireWall to your router.
* Add access-list lines for return traffic, using "establish" and/or defining source ports.

Ths last solution is the most problematic, because it can be dificult to define the return traffic and still protect the network. This is why you should better implement a statefull firewall that insepcts the traffic and allows specific return traffic base on outgoing packets.

Bye
Yizhar Hurwitz

http://come.to/yizhar

http://teachers.sivan.co.il/yizhar

 

[onyx4000]

OK guys, I will try these ideas, thanks a lot, both of you, for your help.