I have an output ACL applied on a WAN interface that permits only 1 IP from going out.

interface Cellular0
 ip address negotiate
 ip access-group allow100.98.170.25 out
 ip nat outside
 no ip unreachables
ip access-list extended allow100.98.170.25
 permit ip host any
 deny   ip any any log

However, when the ACL drops the packet, it makes a loud drop and generates an ICMP unreachable. And because the packet is generated by the control plane, it is not blocked by the ACL.

And even though I have no ip unreachable, it does not work. It appears that I must apply it to the interface which originally received the packet, which could be coming from any LAN. If I do that, my LAN users will not get their ICMP unreachables for legitimate cases.

Is there a way to make ACL drop packets quietly?

If not, is there a way to blackhole post-NAT traffic not matching an ACL?

  • Did you apply the no ip unreachables command to the interface where the traffic enters the router?
    – Ron Maupin
    Commented Sep 28, 2017 at 22:22
  • I guess I did not mentioned it clearly, I did not and it is not practical for me to do that.
    – some user
    Commented Sep 28, 2017 at 22:25
  • 1
    ACL drops do not generate ip unreachables.
    – Ron Trunk
    Commented Sep 28, 2017 at 22:31
  • I believe the router generates the (rate limited) ICMP unreachables after an ACL drop. Is that what you are trying to say?
    – some user
    Commented Sep 28, 2017 at 22:49
  • Did any answer help you? If so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you could provide and accept your own answer.
    – Ron Maupin
    Commented Feb 21, 2018 at 17:41

1 Answer 1


The ICMP unreachable message is generated by the router and sent back through the interface where the original traffic entered the router. Placing the no ip unreachables command on the outside interface does nothing for traffic entering the router on an inside interface. You will need to apply the command on the inside interface for traffic being blocked to the outside interface.

You place the command on the outside interface to block the ICMP message going out for traffic originated outside. You need to place the command on the interface to which the ICMP message would be sent back toward the traffic source. In your case, that appears to be the inside interface.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.