3

I have a Cisco 890 with IOS 15.4. As brief summary of my configuration, FastEthernet 8 is the uplink and NATs the other interfaces (which are grouped into vlan 1).

I'm trying to block access to a specific host or short of that, a network block, but I'm not having luck.

Here's what I've got: 

ip access-list extended wan_ipv4_out
 permit tcp any any
 permit ip any any
 deny   tcp any 208.73.210.0 0.0.1.255

And then to apply it to FastEthernet

interface FastEthernet8
 ip dhcp client client-id ascii router
 ip address dhcp
 ip access-group wan_ipv4_out out
 ip nat outside
 ip virtual-reassembly in
 [... snipped ipv6 stuff ..]

But it doesn't seem to be working. Ideally I'd like to block any IPs that (e.g0 "foo.example.com" resolves to, but this is a temporary hack around a site that's causing me trouble, so I don't mind blocking a whole /23.

Thank you for any help! -Pablo

Improve this question

1 Answer 1

Reset to default
2

With Cisco ACL's, there is an implicit deny ip any any at the end of every list. You need to explicitly state the traffic that you want to allow/deny. Note that it short-circuits on the first ACL entry it hits that it applies to, so if you're sending a packet from a host on the 208.73.210.0/23 network, it will first hit this ACL entry:

permit tcp any any

If it is TCP, it will be allowed regardless of its source. This is a rather moot entry since the next one will allow any source IP address over any protocol. Change it to:

ip access-list extended wan_ipv4_out
  deny tcp any 208.73.210.0 0.0.1.255
  permit ip any any

Note that the 208.73.210.0/23 network will still be able to communicate to other networks over different protocols (UDP, ICMP, etc). To block all outgoing traffic, try:

ip access-list extended wan_ipv4_out
  deny ip any 208.73.210.0 0.0.1.255
  permit ip any any

This will allow all traffic except incoming traffic on FastEthernet8 with a source address of 208.73.210.0/23.

Improve this answer
3
  • So is there a way to specify the order when amending the access-list? Or do I need to nuke it and start over. That deny was at the bottom because I added it after trying other approaches. And thanks for the answer. Seems like I was close. I'll test in the AM and mark as correct.
    – Pablo
    Commented Feb 1, 2015 at 2:08
  • You don't need to erase it and start over :) If you want to remove a single line, you can remove it by typing "no" in front of it and then typing the eaxt same ACL entry. So to remove the second line, you would type "no permit ip any any". To insert an ACL, some routers have an option to put in a sequence number and some require you to use the LINE command.
    – Goodies
    Commented Feb 1, 2015 at 2:15
  • show ip access-lists Notice there are numbers on each line. You can add or remove rules directly by line number. NOTE: IOS will not record those numbers in the config, so after a reload, they will be numbered 10, 20, 30, etc.
    – Ricky
    Commented Feb 1, 2015 at 5:55

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.