ACL: Deny specific host not working

Question

I'm trying to create an acl for use with a nat but I can't get the deny statements working.

All hosts on a private network should be accessible, except from a server which should not be accessible from anywhere but 192.168.10.0 and 192.168.11.0. The router reaches out to an ISP (203.1.1.4) via the IP: 203.1.1.5

This is what I have so far for the acl:

ip access-list extended acltest
remark Prevent server from reaching outside NAT
deny ip 192.168.10.20 0.0.0.0
remark Allow access for other hosts on the networks
permit ip 192.168.10.0 0.0.0.255 any
permit ip 192.168.11.0 0.0.0.255 any

Doing this I get a message about incomplete statements.

I have also tried doing:

deny host 192.168.10.20

...but this returns an "invalid input" message at the start of 'host'.

After checking the list, the permit statements go through but the deny one doesn't. What am I doing wrong with the list? Thanks.

Answer 1

You are using only a source address for the deny in your extended access list (like a standard access list), but an extended access list has both the source and destination address. You do not need an extended ACL for NAT.

A standard ACL should work:

access-list 10 deny host 192.168.10.20
access-list 10 permit 192.168.10.0 0.0.0.255
access-list 10 permit 192.168.11.0 0.0.0.255
!

Also, your next attempt forgets to use the protocol (ip) that an extended ACL requires.

Answer 2

In extended ACLs, the correct syntax is

deny ip <source-ip> <source-wildcard> <destination-ip> <destination-wildcard>

so you'd need at least

deny ip 192.168.10.20 0.0.0.0 0.0.0.0 255.255.255.255

or shorter

deny ip 192.168.10.20/32 any