ACL and the Established parameter

[linglet]

If I create an access list such as:

!

interface FastEthernet0

ip address 192.168.10.1 255.255.255.0

!

interface Serial0

ip unnumbered FastEthernet0

ip access-group 101 in

!

access-list 101 permit tcp any host 192.168.10.10 established

with 192.168.10.1 being the gateway address, when 192.168.10.10 makes a

DNS request to the internet, will I get a response? Does a DNS request constitute an "established connection"?

[nsteup]

No, you will get no response. The implicit deny ip any any of your ACL will block the answer of your DNS requests.DNS is UDP Port 53 normally, so your ACL will not match. Try to add following:

access-list 101 permit udp host "DNS-SERVER-IP" eq DOMAIN host 192.168.10.10

Regards Norbert

[linglet]

Norbert,

Thanks for your reply.

Tracey