Restrict Internet Access

[cigalahgroup]

Hello,

        We have a small network with 30 Users and I would like to block the internet access for the 10 Users. We have DHCP running and all the network is on VLAN1, your help will be appreciated.

Thanks

[Seb Rupik]

Hi there,
First find the MAC addresses of these 10 users and allocate them DHCP reservations from a contiguous block in the subnet.

Say you have the VLAN subnet 10.10.1.0/24, then allocate them IPs from the subnet range 10.10.1.0/28 which will give you the IPs:
10.10.1.0 -> 10.10.1.15

Then on the router interface (or SVI) for your one VLAN, place an ACL in the inbound direction:

!
ip access-list 100 deny ip 10.10.1.0 0.0.0.15 any
ip access-list 100 permit ip any any
!
int vlan1
  ip access-group 100 in
!

If you ever create new routed VLANs you will need to revisit the ACL, but for purely blocking internet access it will work.

cheers,
Seb.

[cigalahgroup]

The above configuration meant that I am blocking ips from 10.10.1.0 -> 10.10.1.15. To achieve this first I have to collect the Mac-Addresses for the know users to which I  have to block.

Can you give me the mac address binding commands as well

[Seb Rupik]

Is the DHCP service running on the router?

If so the command is:

sh ip dhcp server binding

cheers,

Seb.

[cigalahgroup]

Yes Running

[Seb Rupik]

To create a DHCP reservation, assuming you have a DHCP pool like this:

!
ip dhcp pool DHCP_VLAN01
network 10.10.1.0 255.255.255.0
domain-name domain.local
default-router 10.10.1.254
dns-server 8.8.8.8
!

If you have a device with a MAC address aaaa.bbbb.cccc, the client-identifer must be append with '01' and the hex shifted to the right, so aaaa.bbbb.cccc becomes 01aa.aabb.bbcc.cc

A reservation would look like this:

!
ip dhcp pool DHCP_VLAN01-01
  host 10.10.1.1 255.255.255.0
  client-identifier 01aa.aabb.bbcc.cc
!

cheers,

Seb.

[Dennis Mink]

alternatively put a dud proxy pac file on the 10 users machine to go direct for all internal but use a dud proxy ip  for all else.

[cigalahgroup]

How do I achieve this