I have an output ACL applied on a WAN interface that permits only 1 IP from going out.
interface Cellular0 ip address negotiate ip access-group allow100.98.170.25 out ip nat outside no ip unreachables ! ip access-list extended allow100.98.170.25 permit ip host 100.98.170.25 any deny ip any any log !
However, when the ACL drops the packet, it makes a loud drop and generates an ICMP unreachable. And because the packet is generated by the control plane, it is not blocked by the ACL.
And even though I have
no ip unreachable, it does not work. It appears that I must apply it to the interface which originally received the packet, which could be coming from any LAN. If I do that, my LAN users will not get their ICMP unreachables for legitimate cases.
Is there a way to make ACL drop packets quietly?
If not, is there a way to blackhole post-NAT traffic not matching an ACL?