Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I got a CISCO 1800 router. I want to allow a particular domain only. Its clustered so I dont know what the IP address is.


Here is what I need. In cisco routers, I can set the ACL to allow a particular IP. I am setting this up for a corporate using this guide:

For IPs I set something like:

access-list acl_permit permit ip

However, for some sites which I do not want to block, I need to allow particular domains. So I dont want to enter the IP address in the command. How do I go about doing that? Any ideas?

share|improve this question
1 – Chopper3 May 7 '10 at 9:37
Your question doesn't mean anything. Please describe "I want to allow a particular domain only" – radius May 7 '10 at 11:40
Using ACL I want to allow a particular domain. The regular commands allow me to allow IPs but not domains. – elated May 7 '10 at 13:26
You mean something like permit ? if yes do you want to filter only access to website or other kind of flow (smtp, ...) ? – radius May 7 '10 at 15:55
I've down-voted this until you can clarify what you're trying to do; your question is too ambiguous right now. – gravyface May 7 '10 at 16:01
up vote 1 down vote accepted

I am guessing by domain you mean a Windows domain? I am not aware of anything that does this, might be possible by using acls obtained from radius attributes, with a script that generates those radius ACLs based on the domain's properties. That being said, I don't think that would be a good idea. That would be too much integration in my mind for security and practical reasons.

If you mean good old dns, networking doesn't really work like that. Clients accessing say webpage resolve the IP before they send the web request. So the requests are not going to a domain when they reach a router, rather an IP (I'm ignoring HTTP headers and such, but that will just be more confusing).

You generally want to build your ACLs based on UDP/TCP ports and IPs for the most part. I recommend you read a intro Cisco book that not only covers Cisco itself, but how fundamental networking works. Perhaps a good book might be Sybex CCNA. Administering routers with these fundamentals is generally pretty dangerous.

share|improve this answer

You're probably better off implementing WCCP to a filtering proxy than to try to (ab)use the ACL mechanism. The ACLs work on layer 3 (or layer 2, if they're MAC-level ACLs) and have no notion of "domain name". On higher-end routers, the ACLs get compiled into ASIC configuration and will run in programmable hardware rather than be interpreted. Forcing a high-end router to do a DNS lookup frequently (would have to be for every packet to be 100% accurate) would absolutely kill the performance.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.