How do I Restrict Outbound Access?

[kirby449]

Hi Guys

I wish to prevent all outbound http traffic through a PIX from an individual PC sitting behind a PIX firewall. However, I also wish to allow access to one web site from this machine.

Anyone know the commands?

cheers

 

[AJ1982]

access-list goingout permit tcp host 192.168.x.x host 81.x.x.x eq ftp

access-list goingout deny tcp host 192.168.x any

Ta

AJ

===

Fatman Superstar (Andrew James)

CCNA,
(CCNA Cisco Academy Instructor Trained)

 

[baddos]

Just build your access-list, and then apply it to your "inside" interface.

 

[kirby449]

Thanks Fatman and Baddos - I have managed to deny http traffic, however the allowing of one web site doesn't work yet. For example, if I wanted to allow

http://www.bbc.co.uk

presumably I would find the ip address and have:

access-list outbound_deny permit host 192.168.1.6 host 212.58.224.114 eq http

Would this be correct? and also I want to allow smtp traffic from this PC.

Would this be access-list goingout permit tcp host 192.168.1.6 any eq smtp?

Also would I need to enable DNS through port 53 to get the web site to work?

Thanks guys

 

[AJ1982]

>Thanks Fatman and Baddos - I have managed to deny http >traffic, however the allowing of one web site doesn't work >yet. For example, if I wanted to allow

http://www.bbc.co.uk

>presumably I would find the ip address and have:

>access-list outbound_deny permit host 192.168.1.6 host >112.58.224.114 eq http

Correct, you might want to allow the range, depending on their setup.


>Would this be correct? and also I want to allow smtp >traffic from this PC.

You dont have an internal SMTP server?

>Would this be access-list goingout permit tcp host >192.168.1.6 any eq smtp?

Err, carefull who you allow smtp to, you might want to restrict to your smtp server, unless it is of course your mail server.

>Also would I need to enable DNS through port 53 to get the >web site to work?

No internal DNS either???

allow etc... eq dns

HTH

Fat

===

Fatman Superstar (Andrew James)

CCNA,
(CCNA Cisco Academy Instructor Trained)