Here is my configuration on ISP router:
interface GigabitEthernet0/0/0 no ip address duplex auto speed auto ! interface GigabitEthernet0/0/0.10 encapsulation dot1Q 10 ip address 192.168.10.1 255.255.255.0 ip nat inside ! interface GigabitEthernet0/0/0.20 encapsulation dot1Q 20 ip address 192.168.20.1 255.255.255.0 ip nat inside ! interface GigabitEthernet0/0/0.30 encapsulation dot1Q 30 ip address 192.168.30.1 255.255.255.0 ip nat inside ! interface GigabitEthernet0/0/0.40 encapsulation dot1Q 40 ip address 192.168.40.1 255.255.255.0 ip nat inside ! interface GigabitEthernet0/0/0.50 encapsulation dot1Q 50 ip address 192.168.50.1 255.255.255.0 ip nat inside ! interface GigabitEthernet0/0/0.60 encapsulation dot1Q 60 ip address 192.168.60.1 255.255.255.0 ip nat inside ! interface Serial0/1/0 ip address 203.0.113.1 255.255.255.0 ip nat outside ! interface Vlan1 no ip address shutdown ! ip nat inside source list VLANsToPublic interface Serial0/1/0 overload ip classless ip route 0.0.0.0 0.0.0.0 Serial0/1/0 ! ip access-list standard VLANsToPublic permit any ip access-list extended In2Out permit tcp any any eq www permit tcp any any eq 443 permit udp any any eq domain ip access-list extended Out2In permit tcp any host 203.0.113.1 eq www permit tcp any host 203.0.113.1 eq 443 permit udp any host 203.0.113.1 eq domain
There are 6 VLANs. I use NAT to translate them to public IP address as you can see. I use default route to reach outside also. It works fine. Now I want private network to use HTTP and DNS service only.
But when I apply ACL named Out2In to interface S0/1/0
ip access-group Out2In in, it seems to block the connection from public network to this router. Then I remove this command line so router can connect to public network again. But when I apply ACL named In2Out to the same interface
ip access-group In2Out out, PCs in VLANs cannot reach outside. Then I remove the command line, it works again.
Someone explain to me, please. What happened? And what is the right way to apply these rules? Thankyou.