Can anyone tell me what I'm missing here? Trying to set up an ACL that will prohibit any LAN activity while allowing the users to do anything they want outside on the internet if they are accessing the wireless access point.
Here's what I have right now. Internal network is 192.168.1.0 and the gateway/router/etc is at address 192.168.1.254.
Good things about it is, I can't get to anything internal. Also I can get to anything external as long as I know the IP address... so really the only thing I'm missing is DNS resolution. I've tried a few things and nothing seems to work! Any ideas??
Building configuration...
Current configuration : 1802 bytes
!
version 12.3
no service pad
service timestamps debug datetime msec
service timestamps log datetime msec
service password-encryption
!
hostname ap
!
enable secret 5 ....
!
led display alternate
ip subnet-zero
!
!
no aaa new-model
!
dot11 ssid PMIWifi
authentication open
guest-mode
!
power inline negotiation prestandard source
!
!
username ....
!
bridge irb
!
!
interface Dot11Radio0
no ip address
ip access-group wifi in
no ip route-cache
!
ssid PMIWifi
!
speed basic-1.0 basic-2.0 basic-5.5 6.0 9.0 basic-11.0 12.0 18.0 24.0 36.0 48.0
54.0
station-role root
bridge-group 1
bridge-group 1 subscriber-loop-control
bridge-group 1 block-unknown-source
no bridge-group 1 source-learning
no bridge-group 1 unicast-flooding
bridge-group 1 spanning-disabled
!
interface Dot11Radio1
no ip address
ip access-group wifi in
no ip route-cache
!
ssid PMIWifi
!
dfs band 3 block
speed basic-6.0 9.0 basic-12.0 18.0 basic-24.0 36.0 48.0 54.0
channel dfs
station-role root
bridge-group 1
bridge-group 1 subscriber-loop-control
bridge-group 1 block-unknown-source
no bridge-group 1 source-learning
no bridge-group 1 unicast-flooding
bridge-group 1 spanning-disabled
!
interface FastEthernet0
no ip address
no ip route-cache
duplex auto
speed auto
bridge-group 1
no bridge-group 1 source-learning
bridge-group 1 spanning-disabled
hold-queue 160 in
!
interface BVI1
ip address dhcp client-id FastEthernet0
no ip route-cache
!
ip http server
no ip http secure-server
ip http help-path http://www.cisco.com/warp/public/779/smbiz/prodconfig/help/eag
!
ip access-list extended wifi
deny ip any 192.168.1.0 0.0.0.255
permit ip any any
!
control-plane
!
bridge 1 route ip
!
!
!
line con 0
line vty 0 4
login local
!
end
