Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

This is probably something extreamly simple but I am executing the following code to block usage of port 80 on ip and it does not seem to be working. The interface is right and I am using a Cisco Router 2820. Here is the code I used:

(config) access-list 101 deny tcp any host eq 80
(config) access-list 101 permit ip any any
(config-if) ip access-group 101 in
(config-if) ip access-group 101 out

Any thoughts?

share|improve this question
Is the interface you're applying that to a vlan or a physical port? And is it a switched port, or routed? And where is that device relative to the interface's subnet? – Shane Madden Jun 28 '11 at 18:52
This is an actual physical port and not a vlan. It is a routed port as well. The device goes to a switch 3500XL switch first then to the 2820 router which has the ACL on it. – Al Katawazi Jun 28 '11 at 19:09
Where is – Shane Madden Jun 28 '11 at 19:34
up vote 3 down vote accepted

I'm going to venture a guess that is a local device, and that you're trying to prevent it from getting out to the internet on port 80?

If that's the case, then your ACL's a bit backwards; try this:

access-list 101 deny tcp host gt 1023 any eq 80

And the in is the only one you'll need:

ip access-group 101 in
share|improve this answer
what does the gt 1023 do exactly? – Al Katawazi Jun 29 '11 at 12:39
Source ports greater than 1023. See here. If you're trying to block connections to port 80 on all devices, when the connection is sourced from, then this is what you want. – Shane Madden Jun 29 '11 at 15:08
This was really great and helped me out a lot, thank you very much for your post. – Al Katawazi Jul 6 '11 at 1:07

The reason is because you can only apply it IN or OUT, not both at the same time ;).

share|improve this answer
It doesn't make any sense to apply it in and out, but it'll work. – Shane Madden Jun 28 '11 at 20:00
You can certainly apply a single ACL both in- and out-bound. I have done it multiple times. Admittedly prima=rily for "tracking" ACLs (with specific "ip permit" statements for what I am interested in, finishing with a blanket "ip permit any any") – Vatine Jul 1 '11 at 10:18

Might I suggest two ACLs?

Deny traffic coming INTO the router from anywhere destined for on port 80:

(config) access-list 101 deny tcp any host eq 80
(config-if) ip access-group 101 in

Allow any traffic out of the router from anywhere to anywhere:

(config) access-list 102 permit ip any any
(config-if) ip access-group 102 out
share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.