pix 501 access-list 1

[emil60148]

testing Pix 501,i need to allow

http://www access

for everybody in 192.168.1.0 except 192.168.1.3
but with this access-list i stop all users from going outside.
Can't figure out what I am doing wrong. Please help. Thanks

access-list inside_out deny tcp host 192.168.1.3 any eq www
access-list inside_out permit tcp 192.168.1.0 255.255.255.0 any eq www

access-group inside_out in interface inside

 

[tbissett]

My gut reaction is it's a DNS issue. If you implement the access-list and your users have the ISP servers set for their DNS, DNS requests would be denied. You would need to add an additional line to the access-list permitting DNS services, like this:
access-list inside_out deny tcp host 192.168.1.3 any eq www
access-list inside_out permit tcp 192.168.1.0 255.255.255.0 any eq www
access-list inside_out permit udp 192.168.1.0 255.255.255.0 xxx.xxx.xxx.xxx 255.255.255.255 eq domain

(Substitute x's with your DNS server IP)

 

[LloydSev]

that should work beautifully.

although, you don't say specifically that you stop all

http://www going

outside, just that they can't access stuff.

this access list would block *.3 and allow everyone else

http://www access,

but then deny all other traffic coming from the inside to out. What I would do..

access-list inside_out deny tcp host 192.168.1.3 any eq www
access-list inside_out permit ip any any
access-group inside_out in interface inside

Computer/Network Technician
CCNA

 

[emil60148]

Thank you guys,

I just started adding rules and it works great! It was DNS issue as tbisset mentioned. Now i have this config and it works fine

access-list inside_out deny tcp host 192.168.1.3 any eq www
access-list inside_out permit tcp 192.168.1.0 255.255.255.0 any eq www
access-list inside_out permit tcp 192.168.1.0 255.255.255.0 any eq 995
access-list inside_out permit tcp 192.168.1.0 255.255.255.0 any eq smtp
access-list inside_out permit udp 192.168.1.0 255.255.255.0 host xxx.xxx.xxx.xxx eq domain

Do you think i need to add TCP in the DNS requests ?
access-list inside_out permit tcp 192.168.1.0 255.255.255.0 host xxx.xxx.xxx.xxx eq domain

Thanks again, it looks like it's going to be a good Friday