I do not understand why the second ACL is needed if all I want is to ensure all networks use a certain DNS server (for example

access-list 112 permit udp any host eq domain

access-list 112 permit udp any eq domain host (what is the function of this ACL?)

They both seem to be only permitting DNS queries sent to host

  • 2
    Note: DNS is also uses TCP for transport. Allowing only UDP will probably break thinks like DNSSEC. See tools.ietf.org/html/rfc7766 for details. – Jens Link Jun 11 '19 at 18:58

Your ACL currently permits any UDP to port 53 and everything from UDP port 53 to

If you want to deny any DNS access except for you'd need

access-list 112 permit udp any host eq domain
access-list 112 deny udp any any eq domain

You should apply that ACL inbound on the client VLAN or the client-facing interfaces. I'm assuming you've got a longer ACL - note that there's an implied deny any any at the very end.

| improve this answer | |

Your commands have no error. In the next step you need to apply on correct interface with correct directions. You have defined ACL with no errors.

But your requirement is to blocked all other except DNS you need to block other protocols end of ACL.

access-list 112 udp any any eq domain
access-list 112 deny any any

Generally ACL is applied in Interface and direction is measured from interface. If packet transmit direction is toward to Interface direction is IN. If packet transmit from interface it direction will be out.

you can implement using below commands.

ip access-group {access-list-number | access-list-name} {in | out} 
| improve this answer | |

First it seems that this is a single ACL ( number 112 ) with 2 rules. ACL can be applied in inbound or outbound direction ( you should check where it is applied).

access-list 112 permit udp any host eq domain

( This rule allows UDP from ANY source towards host on UDP port 53)

access-list 112 permit udp any eq domain host

( This rule allows all UDP connections from ANY IP source with source UDP port 53 towards host

You can have a look how DNS query normally works in this online packet capture and your ACL if necessary:


| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.