0

I am struggling to get to grips with the ACL on the 2800 series cisco router.

Briefly My topology is R1 > Sw1 > [Server 1, server 2, pc 1]

R1 creates a PPPoE connection, that I'm using right now.

To get to this stage I have the following router configuration. I've stripped out the parts that are not required here to reduce the length of the code snippet.

interface FastEthernet0/0
 no ip address
 ip nat outside
 ip virtual-reassembly
 duplex auto
 speed auto
 pppoe enable group global
 pppoe-client dial-pool-number 10
!
interface FastEthernet0/1
 ip address 10.0.2.1 255.255.255.0
 ip access-group all-out out
 ip nat inside
 ip virtual-reassembly
 duplex auto
 speed auto
 no cdp enable
 no mop enabled
!
interface Serial0/3/0
 no ip address
 shutdown
 clock rate 2000000
!
interface Dialer1
 ip address negotiated
 ip mtu 1492
 ip nat outside
 ip virtual-reassembly
 encapsulation ppp
 ip tcp adjust-mss 1452
 dialer pool 10
 ppp authentication chap callin
 ppp chap hostname *****
 ppp chap password 0 *****
 ppp ipcp dns request
 ppp ipcp route default
 ppp ipcp address accept
!
router rip
 network 10.0.0.0
!
ip classless
!
!
ip http server
no ip http secure-server
ip nat inside source list 10 interface Dialer1 overload
ip nat inside source static tcp 10.0.2.50 443 interface Dialer1 443
ip nat inside source static tcp 10.0.2.50 80 interface Dialer1 80
ip nat inside source static tcp 10.0.2.52 3306 interface Dialer1 3306
ip nat inside source static tcp 10.0.2.41 33060 interface Dialer1 33060
ip nat inside source static tcp 10.0.2.41 8080 interface Dialer1 8080
ip nat inside source static tcp 10.0.2.53 25 interface Dialer1 25
ip nat inside source static tcp 10.0.2.53 587 interface Dialer1 587
ip nat inside source static tcp 10.0.2.53 993 interface Dialer1 993
!
access-list 10 permit 10.0.2.0 0.0.0.255
!

I don't want to permit all traffic in and out. I will be setting up vlans at a later time and extending my home network to include hosts that will have no inbound requirements.

I am using VM's so there are more IP addresses than servers, I have a single public facing up address and multiple hosts behind this router.

I believe the nat is set up correctly but i cannot be sure, im able to get to the hosts locally.

The ACL however ive tried several things and i either lock down the connection or get no apparent result.

So, can you help me with the ACL to maintain the outbound traffic, permit only certain inbound traffic and block anything else inbound.

1 Answer 1

0

On Cisco IOS Routers ACLs are a stateless packet filtering method, meaning that you need to permit traffic both directions, inbound and outbound.

To maintain the outbound traffic and permit only certain inbound traffic, you need a stateful packet filtering feature like "Simple Firewall".

For instance:

conf t
!
ip inspect name firewall tcp    
ip inspect name firewall udp
ip inspect name firewall icmp
!
interface FastEthernet0/1
 ip inspect firewall in
 no ip access-group all-out out
!
ip access-list extended ALLOW-FROM-INTERNET
 permit tcp any any eq 443
 permit tcp any any eq 80
 permit tcp any any eq 3306
 . . .
!
interface Dialer1
 ip access-group ALLOW-FROM-INTERNET in
!

This way, traffic generated in your LAN side (Fa0/1) can go out to the Internet and "Simple Firewall" will keep a record to allow return traffic.

Traffic generated from the WAN side (Dialer1) can only hit your Public IP (Dialer1 IP) if allowed by ACL "ALLOW-FROM-INTERNET".

Take a look at Configuring a Simple Firewall

PS: Make sure you don't lose management access to your Router. Ensure you first try things out while manage it via Console access.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.