-1

I do not understand why the second ACL is needed if all I want is to ensure all networks use a certain DNS server (for example 192.0.2.1)

access-list 112 permit udp any host 192.0.2.1 eq domain

access-list 112 permit udp any eq domain host 192.0.2.1 (what is the function of this ACL?)

They both seem to be only permitting DNS queries sent to host 192.0.2.1.

1

Your ACL currently permits any UDP to 192.0.2.1 port 53 and everything from UDP port 53 to 192.0.2.1.

If you want to deny any DNS access except for 192.0.2.1 you'd need

access-list 112 permit udp any host 192.0.2.1 eq domain
access-list 112 deny udp any any eq domain

You should apply that ACL inbound on the client VLAN or the client-facing interfaces. I'm assuming you've got a longer ACL - note that there's an implied deny any any at the very end.

1

Your commands have no error. In the next step you need to apply on correct interface with correct directions. You have defined ACL with no errors.

But your requirement is to blocked all other except DNS you need to block other protocols end of ACL.

access-list 112 udp any any eq domain
access-list 112 deny any any

Generally ACL is applied in Interface and direction is measured from interface. If packet transmit direction is toward to Interface direction is IN. If packet transmit from interface it direction will be out.

you can implement using below commands.

ip access-group {access-list-number | access-list-name} {in | out} 
0

First it seems that this is a single ACL ( number 112 ) with 2 rules. ACL can be applied in inbound or outbound direction ( you should check where it is applied).

access-list 112 permit udp any host 192.0.2.1 eq domain

( This rule allows UDP from ANY source towards host 192.0.2.1 on UDP port 53)

access-list 112 permit udp any eq domain host 192.0.2.1

( This rule allows all UDP connections from ANY IP source with source UDP port 53 towards host 192.0.2.1)

You can have a look how DNS query normally works in this online packet capture and your ACL if necessary:

http://cloudshark.org/api/v1/45ac0ac4ab8d8b0a98dd7ba18e852681/open?url=http://packetlife.net/captures/DNS%20Question%20%26%20Answer.pcapng.cap

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.