Does ACL check packets originated from the router itself?

[hadel]

My Question as in the title;
Does ACL check packets originated from the router itself or only traffic passing through the router.

Cisco uses the term routed packets in describing the packets challenged by an access list. Does it mean only packets that pass by the router to be routed??

Meaning, if a I have an outgoing access list applied on one interface that prevents telnet. If I telnet from this router itself on some other router on the other end of this interface. Will it be permitted or denied?

Thanks guys

 

[Syty]

The answer is yes. The router will allow itself to telnet the next hop, but a client on another segment coming inbound to that router, will be stopped.



Example,
Workstation - (you)
|
|
eth0
|
|
2501-----ser0-----2511---eth0-----INTERNET

2501 CONFIG
===========
ip access-list ext 101
deny tcp any any eq 23
permit ip any any

interface serial 0
ip access-group 101 out

In the example above,
You are seated at the workstation on the Ethernet segment workstation. If you are connected (console(tty) or vty) to the 2501 and telnet the 2511, you will succeed. If you telnet the 2511 from the command prompt on the workstation you will fail.

You are correct in your definition of "Routed Traffic."

A packet originating from the router is just that. A packet that was received on an incoming interface is considered routed and will be challenged.

 

[hadel]

Thanks Syty for this bulls eye answer. I have another question for you. Is there a way to do it other than preventing telnet on the inbound of the remote router.

Thanks again man
Hazem

 

[Syty]

Well for one, if you are truly trying to prevent vty from the remote router, console the remote router and issue these commands

conf t
line vty 0 4 (could be more than 5 lines, then 0 8, etc..)
no pass
login

This will disable the vty capability on the router. Then you would have to have physical access to it to configure it. No password and forcing a login will give an error of no password set and terminate the session


If you really wanna keep them out and have a laugh, put NAT on the remote router and then redirect all inbound port 23 traffic destined for the connected interface to a webserver on port 80, with a webpage that states Some people get away with anything, now you know you aren't one of them.....

Then put another redirection for some random high port like 3333 and redirect it to another interface port 23 on itself. They would have to use a port scanner on the router to find it. but when you need it, telnet ip address:3333 ....

 

[hadel]

You are the man to ask ........ Thanks a million