ACL and Inspect on Dialer or ethernet interface??

[gael.clavadetscher]

Hello,

I got an ADSL router over isdn with ethernet (inside) for one side and Dialer/atm (Internet) for the other.

I got an "access-group 102 in" on the ethernet interface with inspect to control the outgoing traffic and I got an "access-group 103 in" that I put on the Dialer interface with inspect, this to control the ingoing traffic.

My question will be, is that correct?, or should I put the access-group 103 on the ethernet interface (out?)?

My configuration is working, but will it be more secure, stable, etc, to have the traffic coming from Internet check on the ethernet interface (I heard that, but never knew why?)??

Thanks for your help.

Gael

[fragomez]

Hi,

Both ways will work, now... my suggestion is to keep the incoming ACL on the dialer interface, otherwise you will be allowing traffic through the router, which could be a security hole.

Just think this way, if you want to block all incoming traffic from the Internet and you apply the ACL "out" on the Ethernet interface, I will still have access via telnet, snmp, ssh, http, etc to the dialer interface and I would be able to hack your router.

The rule is, apply the ACL on the interface which is closer to the source.

Let me know if this helps...

Frank