Thank you for the input Sanjay. I was looking for more specific extended ACLs rather than just use extended over standard. Anyone please add or correct me if I'm wrong but this is what I have so far:
on my gi0/0 interface (the same side as the internet) I have placed these extended ACLs and/or commands:
access-list 100 permit icmp any any echo
access-list 100 permit icmp any any echo-reply
access-list 100 permit icmp any any unreachable
access-list 100 deny ip 10.0.0.0 0.255.255.255 any
access-list 100 deny ip 172.16..0.0 0.15.255.255 any
access-list 100 deny ip 192.168.0.0 0.0.255.255 any
access-list 100 deny ip 127.0.0.0 0.255.255.255 any
access-list 100 deny ip host 0.0.0.0 any
access-list 100 deny tcp any any eq 445
access-list 100 deny tcp any any range 137 139
access-list 100 deny ip any any
!
on interface gi0/0 i will enter command:
ip access-group 100 in
For my gi0/1 (internal network side) I plan to use private addresses in the range of 192.168.0.0-192.168.255.255 so I have placed these ACLs:
access-list 101 permit ip 192.168.0.0 0.0.255.255 any
access-list 101 deny ip 10.0.0.0.0 0.255.255.255 any
access-list 101 deny 172.16.0.0 0.15.255.255 any
access-list 101 deny any any
!
on interface gi0/1 i will enter command:
ip access-group 101 in
