We have a Cisco 2901 being used as a small office router.

GigabitEthernet0/1 is connected to an ADSL Modem. GigabitEthernet0/0 is connected to the local LAN with an IP address The network is NAT'd and has Internet access through the ADSL modem.

Here is the config for the LAN interface:

    interface GigabitEthernet0/0
    description ADSL LAN Interface
    ip address
    no ip redirects
    no ip unreachables
    no ip proxy-arp
    ip nat inside
    ip virtual-reassembly
    duplex auto
    speed auto
    no cdp enable

We have no services running that would need any port forwarding from the Internet.

We do have SMB, FTP and other services running just on machines on the LAN.

How would we configure an ACL to prevent Internet access to machines on the LAN?

1 Answer 1


As your hosts are behiend a dynamic nat it is not possible for external host to connect to any host running inside your lan network. The only possible passing packets from the internet to your internal lan will be the reply packets to connections established from your internal hosts

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.