Buy or Renew
Buy or Renew
Cisco + Splunk: It’s a new day for your data. Learn more.
 
cancel
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for 
Search instead for 
Did you mean: 
cancel
Start a conversation
687
Views
0
Helpful
7
Replies

Help configuring ACL's

worldbuilder
Level 1
Level 1

‎11-16-2006 06:59 PM - edited ‎03-05-2019 12:52 PM

Hi all,

I have a 2611 router I have just set up at my house (for learning to get CCNA). It is NOT live on the network yet, though. I want to get some anti-spoofing and regular traffic ACL's in place first before I take it live.

My LAN scheme is 192.168.5.0/24.

I will be setting up DHCP, which I'm comfortable with.

e0/0 is attached to my ISP (Comcast) and will be getting a DHCP address from them.

e0/1 connects to my internal LAN and will be handing out DHCP addresses. It is configured as 192.168.5.73 255.255.255.0.

I have some ACL's in mind that I've developed from reading, but i am wary of my knowledge of ACL's and could use help.

So here we go...

The first one I think I need to write is this (to let my LAN traffic out):

Hercules(config)#access-list 101 deny ip any any

Hercules(config)#access-list 101 permit ip 192.168.5.0 0.0.0.255 any

Hercules(config)#int e0/0

Hercules(config-if)#ip access-group 101 out

Now, in my studies, I THINK this means that ONLY traffic from my LAN ( 192.168.5.0) will be allowed out e0/0, which as stated above connects to the internet. Are my statements right? Wrong? Have I set the interface right, or should that ACL be on e0/1?

Secondly, preventing evil traffic from coming in (as much as possible):

Hercules(config)#access-list 102 deny ip 10.0.0.0 0.255.255.255 any

Hercules(config)#access-list 102 deny ip 127.0.0.0 0.255.255.255 any

Hercules(config)#access-list 102 deny ip 172.16.0.0 0.0.255.255 any

Hercules(config)#access-list 102 deny ip 192.168.0.0 0.0.255.255 any

Hercules(config)#access-list 102 deny ip 224.0.0.0 31.0.255.255 any

Hercules(config)#int e0/1

Hercules(config-if)#ip access-group 102 out

Am I correct in thinking that these are ACL's that will prevent packets spoofed as internal addresses from entering my network through e0/1 (which as stated above connects to my LAN)? Are the commands right, on the right interface, and going the right direction?

And finally, I have a web server (port 80) and a mail server (port 25) running on a linux machine on my LAN. The IP of that machine is 192.168.5.1. Am I correct in thinking that the following two commands will allow access through the 2611 to my server apps?

Hercules(config)#ip nat inside source static tcp 192.168.5.1 80 int e0/1 80

Hercules(config)#ip nat inside source static tcp 192.168.5.1 25 int e0/1 25

... If I've set:

Hercules(config)#int e0/0

Hercules(config-if)#ip nat outside

and

Hercules(config)#int e0/1

Hercules(config-if)#ip nat inside

Will any of my ACL's restrict web or mail server access in any way?

I'd greatly appreciate info from you experts!

Many thanks,

Chris

Labels:
0 Helpful
7 Replies 7

Adam Frederick
Level 3
Level 3

‎11-16-2006 07:11 PM

You don't need to worry about permitting in to out..

The first one I think I need to write is this (to let my LAN traffic out):

Hercules(config)#access-list 101 deny ip any any

Hercules(config)#access-list 101 permit ip 192.168.5.0 0.0.0.255 any

Hercules(config)#int e0/0

Hercules(config-if)#ip access-group 101 out

Also keep in mind you have an implicit

"deny any" at the end of your ACL so you do not need this at the beginning, if you do, you're just going to deny EVERYTHING.

You can control your IN to OUT traffic via NAT. If you only setup a pool for the 192.168.5.0/24 subnet then your going to be ensuring only that subnet gets a global address.

Even though you have a static NAT mapping to your mail and web server, you still need an ACL on your outside interface to permit only these 2 ports.

I.e - access-list 150 permit ip any any eq 25

access-list 150 permit ip any any eq 80

Then the implicit "deny any" will kick in and deny everything else. Trust me, ACLs come with time but they are really simple with small networks.

0 Helpful

worldbuilder
Level 1
Level 1
In response to Adam Frederick

‎11-17-2006 07:14 AM

You don't need to worry about permitting in to out..

The first one I think I need to write is this (to let my LAN traffic out):

Hercules(config)#access-list 101 deny ip any any

Hercules(config)#access-list 101 permit ip 192.168.5.0 0.0.0.255 any

Hercules(config)#int e0/0

Hercules(config-if)#ip access-group 101 out

^^ Ok, so delete this entirely? ^^

Even though you have a static NAT mapping to your mail and web server, you still need an ACL on your outside interface to permit only these 2 ports.

Then the implicit "deny any" will kick in and deny everything else. Trust me, ACLs come with time but they are really simple with small networks.

Ok, so I should write:

Hercules(config)#access-list 150 permit ip any any eq 25

Hercules(config)#access-list 150 permit ip any any eq 80

Hercules(config)#int e0/0

Hercules(config-if)#ip access-group 101 out (or in)?

It would be "in", right, because I want it to filter inbound packets on the outside interface...

So in total, if I understand you right, my entire ACL's would be...

Hercules(config)#access-list 102 deny ip 10.0.0.0 0.255.255.255 any

Hercules(config)#access-list 102 deny ip 127.0.0.0 0.255.255.255 any

Hercules(config)#access-list 102 deny ip 172.16.0.0 0.0.255.255 any

Hercules(config)#access-list 102 deny ip 192.168.0.0 0.0.255.255 any

Hercules(config)#access-list 102 deny ip 224.0.0.0 31.0.255.255 any

Don't I also need ONE permit statement in this ACL? What would that be?

Hercules(config)#int e0/1

Hercules(config-if)#ip access-group 102 out

Hercules(config)#access-list 150 permit ip any any eq 25

Hercules(config)#access-list 150 permit ip any any eq 80

Then I'll have an implicit "deny all".

Hercules(config)#int e0/0

Hercules(config-if)#ip access-group 150 in

Hercules(config)#ip nat inside source static tcp 192.168.5.1 80 int e0/1 80

Hercules(config)#ip nat inside source static tcp 192.168.5.1 25 int e0/1 25

Hercules(config)#int e0/0

Hercules(config-if)#ip nat outside

Hercules(config)#int e0/1

Hercules(config-if)#ip nat inside

Sorry, I am terrible at ACL's...

Many thanks!

Chris

0 Helpful

Sureshdank
Level 1
Level 1

‎11-16-2006 07:16 PM

This access-list which you have implemented on e0/1 i.e. Internal PORT. will itself blockt your internal traffic. Because the access says that deny anything for 192.168.0.0 network.

Hercules(config)#access-list 102 deny ip 192.168.0.0 0.0.255.255 any

Secondly the NAT what you have given is not correct. Just go through this link,

http://www.tech-recipes.com/rx/713/cisco_how_to_configure_nat_network_address_translation

As you are saying that you are configured Web Server and MAIL in your local LAN and you get a Public IP through DHCP then it is not possible for you to host these servers outside world, as the public will be keep on chaiging right.

You need to have static ip for that.

Hope that helps.

Pls. rate the post.

Regards,

Suresh Jain

0 Helpful

weaklinks
Level 1
Level 1
In response to Sureshdank

‎11-17-2006 09:12 AM

great info great links

Thanks

0 Helpful

worldbuilder
Level 1
Level 1
In response to Sureshdank

‎11-17-2006 11:10 AM

This access-list which you have implemented on e0/1 i.e. Internal PORT. will itself block your internal traffic. Because the access says that deny anything for 192.168.0.0 network.

So what if I added Hercules(config)#access-list 102 permit ip 192.168.5.0 0.0.255.255 any - Since 192.168.5.0 is my LAN scheme. Then it should permit my traffic, right?

Secondly the NAT what you have given is not correct. Just go through this link,

http://www.tech-recipes.com/rx/713/cisco_how_to_configure_nat_network_address_translation

So how about:

Hercules(config)#access-list 1 permit 192.168.5.0

Hercules(config)#ip nat inside source list access-list 1 e0/0 overload

Hercules(config)#int e0/0

Hercules(config-if)#ip nat outside

Hercules(config)#int e0/1

Hercules(config-if)#ip nat inside

As you are saying that you are configured Web Server and MAIL in your local LAN and you get a Public IP through DHCP then it is not possible for you to host these servers outside world, as the public will be keep on chaiging right.

Actually, it IS possible. I do it now... But you're right, it's a PITA with DHCP. When my ISP does change my IP address (about twice a year), I have to reroute DNS with my registrar and wait a few days. But I'll need to forward ports through the 2611, so:

Hercules(config)#ip nat inside source static tcp 192.168.5.1 80 int e0/1 80

Hercules(config)#ip nat inside source static tcp 192.168.5.1 25 int e0/1 25

should work, right? Or should the interfaces in the above two commands be e0/0, not e0/1 like they are above?

Thanks guys for all your help.

Chris

0 Helpful

worldbuilder
Level 1
Level 1
In response to worldbuilder

‎11-17-2006 05:38 PM

So after reviewing all the replies from you fine gentlemen, I think I've got it... Remembering that my e0/0 is connected to the internet, e0/1 is connected to the LAN, and that I need to make sure people can still get to me web and mail server at 192.168.5.1, I now have:

Hercules(config)#access-list 1 permit 192.168.5.0

Hercules(config)#ip nat inside source list access-list 1 e0/0 overload

Hercules(config)#int e0/0

Hercules(config-if)#ip nat outside

Hercules(config)#int e0/1

Hercules(config-if)#ip nat inside

^^^^Is this correct for simply NAT'ing and getting all machines on my LAN to the web?^^^^

------------------------------------------------------------------------

Hercules(config)#ip nat inside source static tcp 192.168.5.1 80 int e0/1 80

Hercules(config)#ip nat inside source static tcp 192.168.5.1 25 int e0/1 25

Hercules(config)#access-list 150 permit ip any any eq 25

Hercules(config)#access-list 150 permit ip any any eq 80

Hercules(config-if)#ip access-group 150 e0/0 in

^^^^Is this correct for setting up port forwarding to my web & mail server while denying other traffic?^^^^

------------------------------------------------------------------------

Hercules(config)#access-list 102 deny ip 10.0.0.0 0.255.255.255 any

Hercules(config)#access-list 102 deny ip 127.0.0.0 0.255.255.255 any

Hercules(config)#access-list 102 deny ip 172.16.0.0 0.0.255.255 any

Hercules(config)#access-list 102 deny ip 192.168.0.0 0.0.255.255 any

Hercules(config)#access-list 102 deny ip 224.0.0.0 31.0.255.255 any

Hercules(config)#access-list 102 permit ip 192.168.5.0 0.0.0.255 any

Hercules(config)#int e0/1

Hercules(config-if)#ip access-group 102 out

^^^^Is this correct for setting an anti-spoofing, DoS-attempt ACL while still allowing my 192.168.5.0 network?^^^^

Are my ACL's applied to the right interfaces?

Are my ACL's and NAT going in the right direction?

I greatly appreciate your help, friends! I apologize for having such a hard time with this. Some of the things said, I understand, some I don't.

If, in fact, this is still wrong, could someone possibly rewrite my ACL's to be correct, explaining the differences? That may help me understand better.

Many continued thanks!

Chris

0 Helpful

worldbuilder
Level 1
Level 1
In response to worldbuilder

‎11-18-2006 08:05 PM

Guys, is the above correct?

I certainly don't want to be pushy, but I'd like to get going on this.

Thank you very, very much!

Chris

0 Helpful
Customers Also Viewed These Support Documents
Review Cisco Networking for a $25 gift card