ACLs block connection

Question

Here is my configuration on ISP router:

interface GigabitEthernet0/0/0
 no ip address
 duplex auto
 speed auto
!
interface GigabitEthernet0/0/0.10
 encapsulation dot1Q 10
 ip address 192.168.10.1 255.255.255.0
 ip nat inside
!
interface GigabitEthernet0/0/0.20
 encapsulation dot1Q 20
 ip address 192.168.20.1 255.255.255.0
 ip nat inside
!
interface GigabitEthernet0/0/0.30
 encapsulation dot1Q 30
 ip address 192.168.30.1 255.255.255.0
 ip nat inside
!
interface GigabitEthernet0/0/0.40
 encapsulation dot1Q 40
 ip address 192.168.40.1 255.255.255.0
 ip nat inside
!
interface GigabitEthernet0/0/0.50
 encapsulation dot1Q 50
 ip address 192.168.50.1 255.255.255.0
 ip nat inside
!
interface GigabitEthernet0/0/0.60
 encapsulation dot1Q 60
 ip address 192.168.60.1 255.255.255.0
 ip nat inside
!
interface Serial0/1/0
 ip address 203.0.113.1 255.255.255.0
 ip nat outside
!
interface Vlan1
 no ip address
 shutdown
!
ip nat inside source list VLANsToPublic interface Serial0/1/0 overload
ip classless
ip route 0.0.0.0 0.0.0.0 Serial0/1/0 
!
ip access-list standard VLANsToPublic
 permit any
ip access-list extended In2Out
 permit tcp any any eq www
 permit tcp any any eq 443
 permit udp any any eq domain
ip access-list extended Out2In
 permit tcp any host 203.0.113.1 eq www
 permit tcp any host 203.0.113.1 eq 443
 permit udp any host 203.0.113.1 eq domain

There are 6 VLANs. I use NAT to translate them to public IP address as you can see. I use default route to reach outside also. It works fine. Now I want private network to use HTTP and DNS service only.

But when I apply ACL named Out2In to interface S0/1/0 ip access-group Out2In in, it seems to block the connection from public network to this router. Then I remove this command line so router can connect to public network again. But when I apply ACL named In2Out to the same interface ip access-group In2Out out, PCs in VLANs cannot reach outside. Then I remove the command line, it works again.

Someone explain to me, please. What happened? And what is the right way to apply these rules? Thankyou.

Answer 1

Cisco access-list usage is very well documented and explained. Start with a guide like this for more help.

https://community.cisco.com/t5/networking-knowledge-base/access-control-lists-acl-explained/ta-p/4182349

The main thing you need to consider in your case is designing the ACL to control traffic near its source because you want to restrict traffic outbound from your client devices. The extended ACL should be designed to limit outbound traffic from the source network (client devices) and should be applied to inbound traffic at the interface for the source network, whatever VLAN interface acts as gateway for the client device network you want to restrict.