access lists for internet router

[carl_townshend]

Hi all

Can anyone please give me an example of an access list used on an internet router, one that permits connections from the inside to all the common internet ports, but is secure from the outside ie blocks unwanted incoming connections.

cheers

[Giuseppe Larosa]

Hello Carl,

to perform stateful filtering (if you wants to allow TCP sessions started from inside you are looking at FW like features)  you should use CBAC that requires security feature set.

see the following introduction

http://www.cisco.com/en/US/products/sw/secursw/ps1018/products_tech_note09186a0080094e8b.shtml

Hope to help

Giuseppe

[Joseph W. Doherty]

Disclaimer

The  Author of this posting offers the information contained within this  posting without consideration and with the reader's understanding that  there's no implied or expressed suitability or fitness for any purpose.  Information provided is for informational purposes only and should not  be construed as rendering professional advice of any kind. Usage of this  posting's information is solely at reader's own risk.

Liability Disclaimer

In  no event shall Author be liable for any damages whatsoever (including,  without limitation, damages for loss of use, data or profit) arising out  of the use or inability to use the posting's information even if Author  has been advised of the possibility of such damage.

Posting

For a "pure" ACL approach, please see: http://www.cisco.com/en/US/docs/ios/12_2/security/configuration/guide/scfreflx.html

[Karsten Iwen]

Without further specification I would configure it the folling way:

ip access-list extended OUTSIDE-IN

  deny   ip 0.0.0.0 0.255.255.255 any

  deny   ip 10.0.0.0 0.255.255.255 any

  deny   ip 100.64.0.0 0.63.255.255 any

  deny   ip 127.0.0.0 0.255.255.255 any

  deny   ip 169.254.0.0 0.0.255.255 any

  deny   ip 172.16.0.0 0.15.255.255 any

  deny   ip 192.0.0.0 0.0.0.255 any

  deny   ip 192.0.2.0 0.0.0.255 any

  deny   ip 192.168.0.0 0.0.255.255 any

  deny   ip 198.18.0.0 0.1.255.255 any

  deny   ip 198.51.100.0 0.0.0.255 any

  deny   ip 203.0.113.0 0.0.0.255 any

  deny   ip 224.0.0.0 31.255.255.255 any

!

ip inspect name FW tcp router-traffic

ip inspect name FW udp router-traffic

ip inspect name FW icmp router-traffic

ip inspect name FW ftp                

ip inspect name FW dns

!

interface fastEthernet 0/0

  description external interface

  ip inspect FW out

  ip access-group OUTSIDE-IN in

What does it do:

You enable the stateful inspection in the outbound direction (Adv.Security IOS needed). Traffic initiated from the internal network(s) and the router is inspected to allow the return-traffic.

The incoming ACL on the outside interface is effectively a "deny ip any any". The explicit denys in OUTSIDE-IN are a spoofing-protection which is not really needed if you don't have incoming connections. But it serves for statistics and protection if you later allow connections from the internet into your network. The networks in the ACL are defined in different RFCs to be not allowed on the internet as a source.

The setup can be extended with more inspects for other protocols that use multiple channels. In the example only FTP will work.

If you want you can additionally put an ACL incoming on the inside interface to limit the traffic that your users are allowed to send to the internet.

-- 
Don't stop after you've improved your network! Improve the world by lending money to the working poor:
http://www.kiva.org/invitedby/karsteni

[Giuseppe Larosa]

Hello Karsten,

good post

rated as it deserves

Best Regards

Giuseppe

[Karsten Iwen]

good post
rated as it deserves

Thanks for that!

-- 
Don't stop after you've improved your network! Improve the world by lending money to the working poor:
http://www.kiva.org/invitedby/karsteni