Understanding Cisco standard access lists (Packet Tracer example)

Question

Consider the following example: I have two networks (192.168.1.0 and 192.168.2.0) with one PC in each network (PC0 - 192.168.1.1 and PC1 - 192.168.2.1) and a router R0 with 2 interfaces connecting these networks:

Then I configure a standard access list on the R0's Fa0/1 interface to block traffic outcoming from PC0 to PC1 as:

R0(config)#access-list 1 deny host 192.168.1.1
R0(config)#access-list 1 permit any
R0(config)#interface fa0/1
R0(config-if)#ip access-group 1 out

When I ping PC1 from PC0 I'm getting this result as expected:

C:\>ping 192.168.2.1

Pinging 192.168.2.1 with 32 bytes of data:

Reply from 192.168.1.10: Destination host unreachable.
Reply from 192.168.1.10: Destination host unreachable.
Reply from 192.168.1.10: Destination host unreachable.
Reply from 192.168.1.10: Destination host unreachable.

But when I try to ping PC0 from PC1, I'm getting

C:\>ping 192.168.1.1

Pinging 192.168.1.1 with 32 bytes of data:

Request timed out.
Request timed out.
Request timed out.
Request timed out.

Since the, "access-group 1 out" is configured in R0's interface Fa0/1, it should just only filter traffic coming from the outside, right? So my Ping request should be permitted, but I'm getting the unreachable response.

Why so? I would really appreciate a help on this one.

Answer 1

Ping is an application that is bidirectional. It sends an ICMP request, and expects an ICMP reply. You have broken the traffic from one direction, so you cannot ping either direction (one way the request cannot go through, and the other direction the reply cannot go through).

What you need to do is to use an extended access list that blocks either the the ICMP echo request, or the ICMP echo reply, depending on how you want it to perform.

Answer 2

The keywords "IN" and "OUT" are from the perspective of the router interface. So IN refers to traffic received on the router interface (Into the router), and OUT refers to traffic sent from the router (out of the router interface).