Hello,
I have a router configuration which work logically like this:
Transit provider (via BGP) ---> My 6509 (SUP2T) router's Te3/1 L3 interface ----> TE4/1 switch Gi0/1 ----> Eth0 Server (1.2.3.4)
Because the server is attacked by random UDP packets and random ports, I think my best case would be to filter all UDP packet, except port 53 in my router's Te3/1 interface, on the uplink. My ACL rule looks like this:
Extended IP access list backendfilter
10 permit icmp any host 1.2.3.4
20 permit tcp any host 1.2.3.4
30 permit udp any host 1.2.3.4 eq domain
40 deny ip any host 1.2.3.4
50 permit ip any any
And of course, I applyed it to Te3/1:
interface TenGigabitEthernet3/1
description BGP Uplink Defaultroute
ip address 11.22.33.44
ip access-group backendfilter in
ip verify unicast source reachable-via any allow-default
But it does not work some reason and I don't know why not. If I log into 1.2.3.4 and sniff the packets by tcpdump, I also see the server get the UDP packets:
18:14:44.095168 IP attackerIP1 > 1.2.3.4: ip-proto-17
18:14:44.095186 IP attackerIP2 > 1.2.3.4: ip-proto-17
18:14:44.095190 IP attackerIP3 > 1.2.3.4: ip-proto-17
18:14:44.095194 IP attackerIP4 > 1.2.3.4: ip-proto-17
18:14:44.095196 IP attackerIP5 > 1.2.3.4: ip-proto-17
Something must be wrong with the ACL itself, because if I remove line 10 which allowes the ICMP packet, I also get the pings coming.
There is no other Uplink interface in the router, so it is impossible to get he packets from another link.
I also did a try to enable this ACL to the switch's Te4/1 interface (ip access-group backendfilter out) but it also did not worked for me.
Could somebody please help me out what am I doing wrong?
