Need help blocking port 80

[joeymia]

I want to disable access to port 80 from some inside users. For example I don't want users 192.168.0.70-192.168.0.90 viewing websites. I don't care if they can use other applications I just need 80 blocked. Ive tried using access-list commands and shun but insted it blocked all traffic.

shun 0 80 80 (this wouldn't let me go out anywhere)

access-list luis deny tcp host 192.168.0.70 any eq 80 (same here)

Please help me out I would greatly apreciate it.

 

[dchp]

Try

access-list luis deny tcp host 192.168.0.70 any eq 80
access-list luis permit ip any any

There is an implicit deny at the end of the access list.

 

[N0ktar]

I use access-list commands only to control inbound traffic. To control outgoing connections simply use "outbound" command. You can control access by first blocking all connections and than allowing only specific ports. For example to block a specific user - 192.168.0.70 - in your access list add the following to your configuration:

outbound 1 deny any any
outbound 1 permit 0 0 80
outbound 1 deny 192.168.0.70 255.255.255.255 80
apply (inside) 1 outgoing_src

 

[dchp]

NOktar:

Is the outbound list parsed by the pix in the same fashion as an access-list? IE would your deny any any need to be at the end?

 

[yizhar]

HI.

The outbound command is obsolute and should only be used on very old pix os version.

To control outbound traffic, create an access-list and bind it (access-group) to the inside interface.

Bye
Yizhar Hurwitz

http://come.to/yizhar

http://teachers.sivan.co.il/yizhar

 

[N0ktar]

Your PIX access list is different from the router. The order of a router's access list is vitally important, because the first match will cause a rejection or acceptance. However, the PIX uses a best-fit mechanism for its access lists. This allows the administrator to deny whole ranges of IP addresses and then allow specific hosts through at a later date without having to rewrite the whole access list. The PIX access list is also neither a standard nor an extended access list, but rather a combination of the two forms.