Permit tcp any eq 80 host eq 80

I would like to permit any address to reach the host strictly on port 80

This is a school lab exercise. The question goes, for inbound traffic initiated on the outside network, allow everyone to access only ICMP and HTTP to host 10.23.x.10 All other traffic initiated from outside network must be denied.

Ip access-list extended forext
Permit icmp any host
Permit tcp any eq 80 host eq 80
Deny ip any any

1 Answer 1


The any eq 80 filters for the source port - applying that to a HTTP client makes it near impossible to connect to the server. HTTP clients use ephemeral source ports (49152-65535).

Since you don't know a client's source port you can only filter by destination port

permit tcp any host eq 80

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.