telnet <servername> 80

[S Prvr]

Hi All,

I am having trouble to go out from port 80 in my router. With ACL:public-interface-in, I cannot do telnet www.google.com 80. When I remove ACL, it is working. What else am I missing here ?

Thank you in advance,

interface GigabitEthernet0/0
 ip address xx.xx.xx.99 255.255.255.224
 ip access-group public-interface-in in
 ip nat outside
 ip virtual-reassembly in
 duplex auto
 speed auto
 no cdp enable

ip nat inside source list 23 interface GigabitEthernet0/0 overload
ip route 0.0.0.0 0.0.0.0 xx.xx.xx.97 <----- this is my default gateway

ip access-list extended public-interface-in
 permit icmp any any
 permit tcp any any eq www
 permit tcp any any eq 22
 permit udp any any eq domain
 permit udp any eq domain any

access-list 23 permit 10.0.0.0 0.255.255.255

[Iulian Vaideanu · Accepted solution]

The way it is used that ACL would allow anyone outside to ping your network, to "telnet to" port 80 open on your network, to "telnet to" port 22 open on your network and to DNS-query your network, and allow your network to receive DNS replies.

Everything else coming from outside is denied, including return packets for your "telnet google.com 80" - an additional "permit tcp any eq www any" should allow you to do that.

It's all about where the "eq" is placed (matching source port or destination port), combined with the direction the ACL is applied on the interface (in our out)...

[S Prvr]

that was it! thank you :)