Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I am going much based on my memory and I may not be correct on all of this.

On a Cisco 851 (IOS) that uses a BVI or a bridge-route (the servers on the inside are configured with static and public IP addresses). I would apply two access lists (both end with deny ip any any log) on FastEthernet4 (the WAN port). There would be one for FA4 in and another for FA4 out.
FA4 out would have a line like

access-list 110 permit gt 1023 any eq http

I think this means from 98.76.54.* with a from port of at least 1024 can connect to any other machine with a destination port 80.

So, then I have to allow the response to the HTTP connection.
FA4 in would have a line like

access-list 120 permit any eq http gt 1023

Now the problem with that is that anybody on the outside can set their from port to port 80 and then connect to any inside port that is at least 1024.

How do we prevent this and require the incoming data to be a response to the outgoing data.

share|improve this question
up vote 2 down vote accepted

You will want to permit any established connections, so something like this:

access-list 120 permit tcp any established;jsessionid=CDF341D626FB4FBBF03859E5610B0344.node0

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.