3

I have an ACL configured on an EHWIC card in a 2911 ISR, IOS 15.4, as below.

If I have the rules for blocking port 80 in there, ALL traffic to that port appears to be blocked (SSH, telnet, RDP etc.)

If I remove rules 300 and 400, it seems to work as expected, preventing telnet access, but allowing me to do everything else.

The main thing I need the ACL for though is to block access to a web pages across the network that I can't disable!

ip access-list extended PORT-ACL

100 deny tcp any any eq 23
200 deny tcp any eq 23 any
300 deny tcp any any eq 80
400 deny tcp any eq 80 any
500 deny icmp any any timestamp-reply
600 deny tcp any any eq 8080
700 deny tcp any eq 8080 any
1000 permit ip any any

interface GigabitEthernet1/0/1
description SERVER-DEVICE
ip access-group PORT-ACL in

  • The in and out keywords are from the perspective of the router interface, not the network or VLAN. Your ACL is being applied from the server network into the router, not from the users out to the server network. – Ron Maupin Mar 7 '18 at 16:35
  • Did any answer help you? If so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you could provide and accept your own answer. – Ron Maupin Apr 1 '18 at 21:42
3

Your access list should look like this:

ip access-list extended PORT-ACL

100 deny tcp any any eq 23
300 deny tcp any any eq 80
500 deny icmp any any timestamp-reply
1000 permit ip any any

interface GigabitEthernet1/0/1
description SERVER-DEVICE
ip access-group PORT-ACL OUT  <-- note change

The direction of the access list is in reference to the router, so OUT means from the router to the server. In that case, you will block traffic from other devices to the server when the TCP destination port is 23 or 80.

  • This is probably better practice (fewer rules, less latency!) but it shouldn't have an effect on whether ALL traffic is blocked surely? I'll have a try in some down time over lunch. – Mike Roberts Mar 8 '18 at 9:23
1

The ACL can only operate on data upto the TCP/UDP/ICMP header in the packet. If the TCP dest port number is 80, rule number 300 will drop it even if the TCP payload is SSH or whatever. The application that generated the packet is not known to the ACL implementation, nor does it see the data payload beyond the TCP header, so it has no way to distinguish between "web" traffic and "ssh" traffic if the dest port value is 80.

If the web page that you need to disable access to resides on a particular web server, you can try providing that server's ip address instead of "any".

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.