Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I am going much based on my memory and I may not be correct on all of this.

On a Cisco 851 (IOS) that uses a BVI or a bridge-route (the servers on the inside are configured with static and public IP addresses). I would apply two access lists (both end with deny ip any any log) on FastEthernet4 (the WAN port). There would be one for FA4 in and another for FA4 out.
FA4 out would have a line like

access-list 110 permit 98.76.54.0 0.0.0.255 gt 1023 any eq http

I think this means from 98.76.54.* with a from port of at least 1024 can connect to any other machine with a destination port 80.

So, then I have to allow the response to the HTTP connection.
FA4 in would have a line like

access-list 120 permit any eq http 98.76.54.0 0.0.0.255 gt 1023

Now the problem with that is that anybody on the outside can set their from port to port 80 and then connect to any inside port that is at least 1024.

How do we prevent this and require the incoming data to be a response to the outgoing data.

share|improve this question
add comment

1 Answer

up vote 2 down vote accepted

You will want to permit any established connections, so something like this:

access-list 120 permit tcp any 98.76.54.0 0.0.0.255 established

https://supportforums.cisco.com/docs/DOC-1870;jsessionid=CDF341D626FB4FBBF03859E5610B0344.node0

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.