Cisco Port ACL Rule blocking port 80 appears to block all traffic

Question

I have an ACL configured on an EHWIC card in a 2911 ISR, IOS 15.4, as below.

If I have the rules for blocking port 80 in there, ALL traffic to that port appears to be blocked (SSH, telnet, RDP etc.)

If I remove rules 300 and 400, it seems to work as expected, preventing telnet access, but allowing me to do everything else.

The main thing I need the ACL for though is to block access to a web pages across the network that I can't disable!

ip access-list extended PORT-ACL

100 deny tcp any any eq 23
200 deny tcp any eq 23 any
300 deny tcp any any eq 80
400 deny tcp any eq 80 any
500 deny icmp any any timestamp-reply
600 deny tcp any any eq 8080
700 deny tcp any eq 8080 any
1000 permit ip any any

interface GigabitEthernet1/0/1
description SERVER-DEVICE
ip access-group PORT-ACL in

Answer 1

Your access list should look like this:

ip access-list extended PORT-ACL

100 deny tcp any any eq 23
300 deny tcp any any eq 80
500 deny icmp any any timestamp-reply
1000 permit ip any any

interface GigabitEthernet1/0/1
description SERVER-DEVICE
ip access-group PORT-ACL OUT  <-- note change

The direction of the access list is in reference to the router, so OUT means from the router to the server. In that case, you will block traffic from other devices to the server when the TCP destination port is 23 or 80.

Answer 2

The ACL can only operate on data upto the TCP/UDP/ICMP header in the packet. If the TCP dest port number is 80, rule number 300 will drop it even if the TCP payload is SSH or whatever. The application that generated the packet is not known to the ACL implementation, nor does it see the data payload beyond the TCP header, so it has no way to distinguish between "web" traffic and "ssh" traffic if the dest port value is 80.

If the web page that you need to disable access to resides on a particular web server, you can try providing that server's ip address instead of "any".