I have a Cisco 890 with IOS 15.4. As brief summary of my configuration, FastEthernet 8 is the uplink and NATs the other interfaces (which are grouped into vlan 1).

I'm trying to block access to a specific host or short of that, a network block, but I'm not having luck.

Here's what I've got:

ip access-list extended wan_ipv4_out
 permit tcp any any
 permit ip any any
 deny   tcp any

And then to apply it to FastEthernet

interface FastEthernet8
 ip dhcp client client-id ascii router
 ip address dhcp
 ip access-group wan_ipv4_out out
 ip nat outside
 ip virtual-reassembly in
 [... snipped ipv6 stuff ..]

But it doesn't seem to be working. Ideally I'd like to block any IPs that (e.g0 "foo.example.com" resolves to, but this is a temporary hack around a site that's causing me trouble, so I don't mind blocking a whole /23.

Thank you for any help! -Pablo

1 Answer 1


With Cisco ACL's, there is an implicit deny ip any any at the end of every list. You need to explicitly state the traffic that you want to allow/deny. Note that it short-circuits on the first ACL entry it hits that it applies to, so if you're sending a packet from a host on the network, it will first hit this ACL entry:

permit tcp any any

If it is TCP, it will be allowed regardless of its source. This is a rather moot entry since the next one will allow any source IP address over any protocol. Change it to:

ip access-list extended wan_ipv4_out
  deny tcp any
  permit ip any any

Note that the network will still be able to communicate to other networks over different protocols (UDP, ICMP, etc). To block all outgoing traffic, try:

ip access-list extended wan_ipv4_out
  deny ip any
  permit ip any any

This will allow all traffic except incoming traffic on FastEthernet8 with a source address of

  • So is there a way to specify the order when amending the access-list? Or do I need to nuke it and start over. That deny was at the bottom because I added it after trying other approaches. And thanks for the answer. Seems like I was close. I'll test in the AM and mark as correct.
    – Pablo
    Feb 1, 2015 at 2:08
  • You don't need to erase it and start over :) If you want to remove a single line, you can remove it by typing "no" in front of it and then typing the eaxt same ACL entry. So to remove the second line, you would type "no permit ip any any". To insert an ACL, some routers have an option to put in a sequence number and some require you to use the LINE command.
    – Goodies
    Feb 1, 2015 at 2:15
  • show ip access-lists Notice there are numbers on each line. You can add or remove rules directly by line number. NOTE: IOS will not record those numbers in the config, so after a reload, they will be numbered 10, 20, 30, etc.
    – Ricky
    Feb 1, 2015 at 5:55

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.