1

We have a Cisco 2901 being used as a small office router.

GigabitEthernet0/1 is connected to an ADSL Modem. GigabitEthernet0/0 is connected to the local LAN with an IP address 192.168.1.1. The network 192.168.1.0 is NAT'd and has Internet access through the ADSL modem.

Here is the config for the LAN interface:

    interface GigabitEthernet0/0
    description ADSL LAN Interface
    ip address 192.168.1.1 255.255.255.0
    no ip redirects
    no ip unreachables
    no ip proxy-arp
    ip nat inside
    ip virtual-reassembly
    duplex auto
    speed auto
    no cdp enable
    !

We have no services running that would need any port forwarding from the Internet.

We do have SMB, FTP and other services running just on machines on the LAN.

How would we configure an ACL to prevent Internet access to machines on the LAN?

2

As your hosts are behiend a dynamic nat it is not possible for external host to connect to any host running inside your lan network. The only possible passing packets from the internet to your internal lan will be the reply packets to connections established from your internal hosts

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.