Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

This seemed simple enough but I have to be missing something. I have the following config to block all DNS request from the inside that are not going to the allowed external DNS server.

access-list INSIDE-ACCESS-OUT extended permit udp any object open-dns1 eq domain
access-list INSIDE-ACCESS-OUT extended permit udp any object open-dns2 eq domain
access-list INSIDE-ACCESS-OUT extended permit tcp any object open-dns1 eq domain
access-list INSIDE-ACCESS-OUT extended permit tcp any object open-dns2 eq domain
access-list INSIDE-ACCESS-OUT extended deny udp any any eq domain
access-list INSIDE-ACCESS-OUT extended deny tcp any any eq domain
access-list INSIDE-ACCESS-OUT extended permit ip any any

access-group INSIDE-ACCESS-OUT out interface inside

DNS can still get out to any server and packet tracer doesn't show the ACL being hit.

share|improve this question
up vote 2 down vote accepted

Your ACL is applied backwards. You're applying it to packets going out the inside interface (From the internet to your internal hosts). This should fix it:

no access-group INSIDE-ACCESS-OUT out interface inside
access-group INSIDE-ACCESS-OUT in interface inside
share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.