We have a Cisco 2901 being used as a small office router.
GigabitEthernet0/1 is connected to an ADSL Modem. GigabitEthernet0/0 is connected to the local LAN with an IP address 192.168.1.1. The network 192.168.1.0 is NAT'd and has Internet access through the ADSL modem.
Here is the config for the LAN interface:
description ADSL LAN Interface
ip address 192.168.1.1 255.255.255.0
no ip redirects
no ip unreachables
no ip proxy-arp
ip nat inside
no cdp enable
We have no services running that would need any port forwarding from the Internet.
We do have SMB, FTP and other services running just on machines on the LAN.
How would we configure an ACL to prevent Internet access to machines on the LAN?