I am having trouble with allowing my internal system (Administration) public web access after denying any of the public access to my internal systems. Here is my ACL on my router so far:

  Extended IP access list Public
        10 deny tcp any 
        20 deny udp any
        30 deny ip any 
        40 deny icmp any
        50 permit tcp host
  • - public subnet
  • - Admin subnet
  • - Public web

How will I simultaneously block public host access to my internal network, but allow my internal hosts access to the public Internet?

  • It would be easier to understand if you can provide a simple diagram.
    – Ron Trunk
    Oct 16 '17 at 18:27
  • Public ------ Router --------Adminstration
    – neoncolors
    Oct 16 '17 at 18:33
  • Did any answer help you? If so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you can provide and accept your own answer.
    – Ron Maupin
    Feb 19 '18 at 19:40

It sounds like you only want to allow an inside address to establish a TCP connection. If you use NAT from your privately addressed network to the public Internet, it is stateful, and it works the way you seem to want.

If you have public addresses on both sides of your router, you could do something like this (there are multiple ways this could look, depending on exactly what you want to do):

interface GigabitEthernet0/0
 description WAN connection
 ip address
 ip access-group OUTBOUND_ONLY in

ip access-list extended OUTBOUND_ONLY
 permit tcp any any established

This will allow inside hosts to originate TCP connections to outside hosts, and allow the outside hosts to respond on the established connections, but it will block any other traffic from the outside.

Cisco maintains many documents for things like this (just search). For example, Configure Commonly Used IP ACLs:

Allow Only Internal Networks to Initiate a TCP Session

This figure shows that TCP traffic sourced from NetA destined to NetB is permitted, while TCP traffic from NetB destined to NetA is denied.

enter image description here

The purpose of the ACL in this example is to:

  • Allow hosts in NetA to initiate and establish a TCP session to hosts in NetB.
  • Deny hosts in NetB from initiating and establishing a TCP session destined to hosts in NetA.

This configuration allows a datagram to pass through interface Ethernet 0 inbound on R1 when the datagram has:

  • Acknowledged (ACK) or reset (RST) bits set (indicating an established TCP session)
  • A destination port value greater than 1023


hostname R1  
interface ethernet0  
 ip access-group 102 in  
access-list 102 permit tcp any any gt 1023 established

Since most of the well-known ports for IP services use values less than 1023, any datagram with a destination port less than 1023 or an ACK/RST bit not set is denied by ACL 102. Therefore, when a host from NetB initiates a TCP connection by sending the first TCP packet (without synchronize/start packet (SYN/RST) bit set) for a port number less than 1023, it is denied and the TCP session fails. The TCP sessions initiated from NetA destined to NetB are permitted because they have ACK/RST bit set for returning packets and use port values greater than 1023.


I think I understand what you are trying to achieve but the question and setup/config you have so far is a little confusing.

First of all, do you have the ip address ranges (ip address/subnet mask)?

Second, have you considered using two access lists. One on the "Outside" interface to block public access to your internal servers/services and one on the "Inside" interface to allow all or specific machines to access the Internet?

Thirdly, you have mixed ip, tcp and udp in the deny statements. If you want to block all then just use ip.

Web -> Outside Interface -> ACL -> Router -> ACL <- Inside Interface

Out of interest, what cisco router are you using?

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.