I have a Cisco 890 with IOS 15.4. As brief summary of my configuration, FastEthernet 8 is the uplink and NATs the other interfaces (which are grouped into vlan 1).
I'm trying to block access to a specific host or short of that, a network block, but I'm not having luck.
Here's what I've got:
ip access-list extended wan_ipv4_out permit tcp any any permit ip any any deny tcp any 126.96.36.199 0.0.1.255
And then to apply it to FastEthernet
interface FastEthernet8 ip dhcp client client-id ascii router ip address dhcp ip access-group wan_ipv4_out out ip nat outside ip virtual-reassembly in [... snipped ipv6 stuff ..]
But it doesn't seem to be working. Ideally I'd like to block any IPs that (e.g0 "foo.example.com" resolves to, but this is a temporary hack around a site that's causing me trouble, so I don't mind blocking a whole /23.
Thank you for any help! -Pablo