ACL on WAN interface

[Kingsleyizuka]

Hi Everyone,

I've a Cisco router running IOS 12.4 but it seems impossible to configure an ACL to restrict access to a particular IP outside the network i.e. on the internet.

When I used "deny ip" or "deny tcp" and applied "IN" acl group on the interface, it restricted access to all IP or TCP request on that interface respectively. "IN" is the only option available in the IOS.

For example, to block access to google:

access-list 190 deny ip any 216.58.223.206 0.0.0.0

OR

access-list 190 deny tcp any 216.58.223.206 0.0.0.0

and apply to the interface

access-group 190 IN (because ONLY "IN" option is available)

Also, why does the IOS have only IN option for applying the ACL?

Thanks.

Tell me, I’ll forget; Show me, I’ll remember; Involve me, I’ll understand

~ Chinese Proverb

[Jon Marshall · Accepted solution]

Don't know why you cannot apply an acl outbound but you can apply the acl inbound on your LAN interface. 

Don't forget "permit ip any any" in your acl for all the other traffic. 

Jon

[Kingsleyizuka · Accepted solution]

Thanks.

But isn't "permit ip any any" implicitly added on all lists.

I was expecting implicit permit for all other traffic.

Then, if you need to customise you could use:

"no permit any any" on the ACLs.

Also, I understand that ACLs rules are better written for INBOUND traffic because the rules are applied before reaching the router/core network. Thereby preventing unnecessary congestion.

Tell me, I’ll forget; Show me, I’ll remember; Involve me, I’ll understand

~ Chinese Proverb

[Joseph W. Doherty]

"But isn't "permit ip any any" implicitly added on all lists."

No, it's the opposite. There's an implicit deny all at the end of any ACL.