I'm trying to create an acl for use with a nat but I can't get the deny statements working.

All hosts on a private network should be accessible, except from a server which should not be accessible from anywhere but and The router reaches out to an ISP ( via the IP:

This is what I have so far for the acl:

ip access-list extended acltest
remark Prevent server from reaching outside NAT
deny ip
remark Allow access for other hosts on the networks
permit ip any
permit ip any

Doing this I get a message about incomplete statements.

I have also tried doing:

deny host

...but this returns an "invalid input" message at the start of 'host'.

After checking the list, the permit statements go through but the deny one doesn't. What am I doing wrong with the list? Thanks.

2 Answers 2


You are using only a source address for the deny in your extended access list (like a standard access list), but an extended access list has both the source and destination address. You do not need an extended ACL for NAT.

A standard ACL should work:

access-list 10 deny host
access-list 10 permit
access-list 10 permit

Also, your next attempt forgets to use the protocol (ip) that an extended ACL requires.

  • It worked after I changed everything to a standard list. I did, however, try and use the extended list, by simply adding 'ip' before the 'host' keyword (on the second attempt). This didn't end up working. Is it because I didn't specify the destination address? Thanks.
    – zusumifa
    Apr 14, 2019 at 5:24
  • Yes. Extended ACLs require the protocol, source, and destination. I really do not see a reason to use a NAT extended ACL if your destination is any.
    – Ron Maupin
    Apr 14, 2019 at 13:24

In extended ACLs, the correct syntax is

deny ip <source-ip> <source-wildcard> <destination-ip> <destination-wildcard>

so you'd need at least

deny ip

or shorter

deny ip any

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.