Only allow subnet to internet

[HamDawg]

Hi all, hoping to get your guidance here... hopefully, i am in the correct forum.

how can i build an ACL to only allow a subnet to internet and no where else within the network?

i have a VLAN xxx that i would like to deny access to everywhere and only out to the internet.

what would be the deny statements?
ip access-list extended 172.x.x.0 0.0.0.255 deny
permit ??
how would apply this on the vlan interface?

do i also have a static route for that network to my internet interface?

thank you in advance,

[Rob Ingram · Accepted solution]

@HamDawg create an ACL with the first line as a deny from the local network to the rest of the local networks, then permit ip any any. Which would allow you internet access, whilst denying access to local resources.

Not knowing your full intentions, you may need to permit DHCP, DNS to local resources? If so, add these above the deny rule.

You would apply the ACL on the SVI.

Example:

ip access-list extended INTERNET-ACCESS-ACL
 deny ip 172.16.0.0 0.0.0.255 172.16.0.0 0.0.255.255
 permit ip any any
!
interface vlan X
 ip access-group INTERNET-ACCESS-ACL in

[MHM Cisco World]

i have a VLAN xxx that i would like to deny access to everywhere and only out to the internet.??
the direction of ACL is IN 
but the Q here what you meaning of everywhere ?

[Marius Gunnerud]

If you want to deny traffic to everything other than internet, then you will need to first deny traffic towards RFC1918 and then permit any.  Something like the following.

ip access-list extended INET_ONLY
deny ip 172.x.x.0 0.0.0.255 10.0.0.0 0.255.255.255
deny ip 172.x.x.0 0.0.0.255 172.16.0.0 0.15.255.255
deny ip 172.x.x.0 0.0.0.255 192.168.0.0 0.0.255.255
permit ip 172.x.x.0 0.0.0.255 any

int vlan xxx
ip access-group INET_ONLY in

[ammahend]

with your subnet as source, you can deny access to RFP 1918 as destination which comprises of all private IP range  in the IN direction on SVI as suggested by Marius below, however keep in mind that some services are essential for endpoints to function like DHCP, DNS, NTP, Domain etc, so you can allow them at top, then deny RFP 1918, then permit all.