pix block ports for subdomain 2

[dgoradia]

How can I block outside internet access for everyone using gateway/subdomain 192.168.0.1 and only allow access for subdomain e.g. 192.168.6.1....

Thanks

 

[unclerico]

well, assuming that your requirements are truly to block http/s traffic outbound from the 192.168.0.x/24 and permit http/s traffic from the 192.168.6.x/24 then the ACL would look like this:

access-list inside_access_in extended deny tcp 192.168.0.0 255.255.255.0 any eq www
access-list inside_access_in extended deny tcp 192.168.0.0 255.255.255.0 any eq https
access-list inside_access_in extended permit tcp 192.168.6.0 255.255.255.0 any eq www
access-list inside_access_in extended permit tcp 192.168.6.0 255.255.255.0 any eq https

notice that there is an implied deny ip any any at the bottom of the ACL so any other traffic besides http/s from 192.168.6.0/24 will be denied.

I hate all Uppercase... I don't want my groups to seem angry at me all the time! =)
- ColdFlame (vbscript forum)

 

[mjoyner]

Uncle....... so first deny....... then allow?

[root@netwatch ~]# yum remove windows
Loaded plugins: fastestmirror
Setting up Remove Process
No Match for argument: windows
No Packages marked for removal

OH YEAH!

 

[unclerico]

in this particular case it doesn't matter for the order. you could just as easily put the permit statements first and deny statements last. the OP never came back to clarify the requirements.

I hate all Uppercase... I don't want my groups to seem angry at me all the time! =)
- ColdFlame (vbscript forum)

 

[mjoyner]

thanks Uncle.

[root@netwatch ~]# yum remove windows
Loaded plugins: fastestmirror
Setting up Remove Process
No Match for argument: windows
No Packages marked for removal

OH YEAH!

 

[mjoyner]

I just read on cisco site, its a first match rule for ACLS.

[root@netwatch ~]# yum remove windows
Loaded plugins: fastestmirror
Setting up Remove Process
No Match for argument: windows
No Packages marked for removal

OH YEAH!

 

[unclerico]

right, and that's why in this case it doesn't matter which one you put first; deny or permit

I hate all Uppercase... I don't want my groups to seem angry at me all the time! =)
- ColdFlame (vbscript forum)

 

[Supergrrover]

If you have a more general mask on the ACL it will block the traffic before it gets to the more specific ACL statement. On a hunch - do you have more than two subnets?
(ie - 192.168.0.0, 192.168.1.0, 192.168.2.0, etc.)

If that is the case and you want all of them blocked except the 192.168.6.0 then the order (and masking) matters

access-list inside_access_in extended permit tcp 192.168.6.0 255.255.255.0 any eq www
access-list inside_access_in extended permit tcp 192.168.6.0 255.255.255.0 any eq https
access-list inside_access_in extended deny tcp 192.168.0.0 255.255.0.0 any eq www
access-list inside_access_in extended deny tcp 192.168.0.0 255.255.0.0 any eq https

This will allow the 192.168.6.0 network and block the 192.168.0.0-255.0 supernetted network



Brent
Systems Engineer / Consultant
CCNP, CCSP

 

[mjoyner]

Supergrgrover, that makes sense then, so you can make catchalls for the subs.

[root@netwatch ~]# yum remove windows
Loaded plugins: fastestmirror
Setting up Remove Process
No Match for argument: windows
No Packages marked for removal

OH YEAH!

 

[Supergrrover]

Yes. Exactly. If you only have the .0.0 and the .6.0 networks then as long as the mask is /24 it won't matter.


Brent
Systems Engineer / Consultant
CCNP, CCSP

 

[dgoradia]

Thank you @unclerico and @Supergrrover for the ACL, i really appreciate it.

Could you direct me to a tutorial or some kind of resource that would teach me how to configure these?

Once again, thanks for the great solution...

 

[dgoradia]

By the way, this is exactly what i was looking for. unclerico's acl worked perfectly. Also Supergrrover gave me a little more insight into it as we do have multiple subdomains here, so i changed to Supergrrover's acl and all the subdomains were blocked. Thanks. I needed to block it for a while for some important clients.

 

[Supergrrover]

Here you go -

http://www.cisco.com/en/US/products/ps6120/products_configuration_example09186a0080862017.shtml

Brent
Systems Engineer / Consultant
CCNP, CCSP

 

[burtsbees]

Mjoyner

Uncle....... so first deny....... then allow?

No---they are all separate subnets---look at the mask after 192.168.0.0---it will block 192.168.0.1 through 192.168.0.254.
If 192.168.6.34 (example)comes in, the PIX will not find a match for it until the third line. Perhaps you were thinking that 192.168.0.0/16 was the requirement, in which case it WOULD block 192.168.6.34.

/

tim@tim-laptop ~ $ sudo apt-get install windows
Reading package lists... Done
Building dependency tree
Reading state information... Done
E: Couldn't find package windows...Thank Goodness!

 

[mjoyner]

Hey Burt, hope your weekend was nice.

I read up on that, I learned that ACL's are a first match rule.

I see what you mean, the MASK got wider.



[root@netwatch ~]# yum remove windows
Loaded plugins: fastestmirror
Setting up Remove Process
No Match for argument: windows
No Packages marked for removal

OH YEAH!