Tell me more ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.
up vote 1 down vote favorite
1

This is probably something extreamly simple but I am executing the following code to block usage of port 80 on ip 192.168.1.50 and it does not seem to be working. The interface is right and I am using a Cisco Router 2820. Here is the code I used:

(config) access-list 101 deny tcp any host 192.168.1.50 eq 80
(config) access-list 101 permit ip any any
(config-if) ip access-group 101 in
(config-if) ip access-group 101 out

Any thoughts?

share|improve this question
Is the interface you're applying that to a vlan or a physical port? And is it a switched port, or routed? And where is that 192.168.1.50 device relative to the interface's subnet? – Shane Madden Jun 28 '11 at 18:52
This is an actual physical port and not a vlan. It is a routed port as well. The device goes to a switch 3500XL switch first then to the 2820 router which has the ACL on it. – Al Katawazi Jun 28 '11 at 19:09
Where is 192.168.1.50? – Shane Madden Jun 28 '11 at 19:34

3 Answers

up vote 3 down vote accepted

I'm going to venture a guess that 192.168.1.50 is a local device, and that you're trying to prevent it from getting out to the internet on port 80?

If that's the case, then your ACL's a bit backwards; try this:

access-list 101 deny tcp host 192.168.1.50 gt 1023 any eq 80

And the in is the only one you'll need:

ip access-group 101 in
share|improve this answer
what does the gt 1023 do exactly? – Al Katawazi Jun 29 '11 at 12:39
Source ports greater than 1023. See here. If you're trying to block connections to port 80 on all devices, when the connection is sourced from 192.168.1.50, then this is what you want. – Shane Madden Jun 29 '11 at 15:08
This was really great and helped me out a lot, thank you very much for your post. – Al Katawazi Jul 6 '11 at 1:07
up vote 0 down vote

The reason is because you can only apply it IN or OUT, not both at the same time ;).

share|improve this answer
1  
It doesn't make any sense to apply it in and out, but it'll work. – Shane Madden Jun 28 '11 at 20:00
You can certainly apply a single ACL both in- and out-bound. I have done it multiple times. Admittedly prima=rily for "tracking" ACLs (with specific "ip permit" statements for what I am interested in, finishing with a blanket "ip permit any any") – Vatine Jul 1 '11 at 10:18
up vote 0 down vote

Might I suggest two ACLs?

Deny traffic coming INTO the router from anywhere destined for 192.168.1.50 on port 80:

(config) access-list 101 deny tcp any host 192.168.1.50 eq 80
(config-if) ip access-group 101 in

Allow any traffic out of the router from anywhere to anywhere:

(config) access-list 102 permit ip any any
(config-if) ip access-group 102 out
share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.