How to limit telnet access to only local network users in Cisco [closed]

Question

I need to make so that my telnet service is only reachable by local users, not by anyone from outside in Cisco Packet tracer. Any suggestions please?

https://i.stack.imgur.com/ZAd9L.png

Answer 1

First, you need to create a standard access list. For example:

access-list 10 remark --Restrict Telnet Access--
access-list 10 permit 192.168.10.0 0.0.0.255
access-list 10 deny any log 

You don't need the last line, as there is an implicit (assumed) deny at the end of a standard access list, but I personally like to make it explicit and to log violations.

From there, on your vty lines add the access-class statement:

line vty 0 4
access-class 10 in
line vty 5 15
access-class 10 in

Make sure you apply it to all vty lines. In my example, I just applied it to the default vty lines that are on most Cisco devices.

Edit: Just saw the image link in a comment on the other answer and this seems to indicate you have an actual server designated for providing telnet access, rather than looking to limit telnet to the Cisco devices themselves.

For this, the ACL as suggested in the other answer would be best applied to the outside interface of router1. For example:

access-list 101 remark --Outside interface inbound--
access-list 101 deny tcp any host <IP address of telnet server> eq 23
access-list 101 permit ip any any

This will block all traffic from outside of router1 destined to the telnet server.

Answer 2

[EDIT]: With the image you now have supplied, the access list should be placed on the router interface inbound from your ISP. Assuming Router2 is the internet connected path, placement should be made at Router1, and inbound on the interface connected to Router2 if Router2 is owned by your ISP. If Router2 is owned by you and connected to your ISP, placement should be made there.

To block only telnet at the perimeter you need just two lines in the access list:

access-list 101 deny tcp any any eq 23
access-list 101 permit ip any any

I would still suggest reading the Cisco link below as it contains the rudimentary access list practice and syntax. In a design such as you have drafted, you would likely wish to block more than just telnet.

Suggested in-depth reading is:

• the Cisco IOS hardening guide for your IOS versions and devices, as the design info you give indicates them as being fairly wide open to the internet, Here is one such guide for inspiration.
• the excellent Firewalls for Dummies. This is not written by way of a joke or a taunt, it really is one of the best introductory books on the market for this complex topic.

---

Use an accesslist.

If the router has the ip address 192.168.0.10 on the e0 interface and should permit telnet just from the local subnet 192.168.0.0/24 to the e0 interface:

interface ethernet0
ip access-group 101 in
!
access-list 101 permit tcp 192.168.0.0  0.0.0.255 host 192.168.0.10 eq 23
access-list 101 deny tcp any any eq 23
access-list 101 permit ip any any

Note that this example would also block telnet from the 192.168.0.0/24 subnet to other devices on the far side of the router. This can easily be customized in the access list.

If you want to block telnet completely I suggest not to activate it in the first place.

Common Cisco access list entries are decribed here.