We have a Cisco 2901 being used as a small office router.
GigabitEthernet0/1 is connected to an ADSL Modem. GigabitEthernet0/0 is connected to the local LAN with an IP address 192.168.1.1. The network 192.168.1.0 is NAT'd and has Internet access through the ADSL modem.
Here is the config for the LAN interface:
interface GigabitEthernet0/0 description ADSL LAN Interface ip address 192.168.1.1 255.255.255.0 no ip redirects no ip unreachables no ip proxy-arp ip nat inside ip virtual-reassembly duplex auto speed auto no cdp enable !
We have no services running that would need any port forwarding from the Internet.
We do have SMB, FTP and other services running just on machines on the LAN.
How would we configure an ACL to prevent Internet access to machines on the LAN?