The problem is when someone contacted your protectedserver, you need to allow the counter flow of that. For example, you need to have: permit tcp host PROTECTEDSERVER eq 80 any gt 1024 so that the web counter flow will work (counter flow of this line: permit tcp any host PROTECTEDSERVER eq 80)
-lmn On Tue, Jun 3, 2008 at 1:23 PM, Skeeve Stevens <[EMAIL PROTECTED]> wrote: > > Hey all, > > Got an issue with the below ACL. The inbound to the PROTECTEDSERVER is > working ok.. port 80 is allowed, RDP from one trusted machine. > But. on the outbound, with the deny ip any any active (notice the !), the > inbound wont work, nor can the server get out. > > What am I missing? > > Basically what I want to do is deny all, allow only certain things.. > > .Skeeve > > ! > no ip access-list extended FWCUST_XXX_IN > ip access-list extended FWCUST_XXX_IN > remark Inbound Firewall rules for XXX Services > permit tcp any host PROTECTEDSERVER established > permit tcp host ALLOWEDREMOTE host PROTECTEDSERVER eq 3389 > permit tcp any host PROTECTEDSERVER eq 80 > permit icmp any any > deny ip any any > ! > no ip access-list extended FWCUST_XXX_OUT > ip access-list extended FWCUST_XXX_OUT > remark Outbound Firewall rules for XXX Services > permit tcp any any established > permit tcp PROTECTEDSERVER host SAFEMAIL eq smtp > permit tcp host PROTECTEDSERVER host SAFEMAIL eq pop3 > permit icmp any any > permit tcp host PROTECTEDSERVER any eq domain > permit udp host PROTECTEDSERVER any eq domain > permit tcp host PROTECTEDSERVER any eq 80 > permit tcp host PROTECTEDSERVER any eq 21 > permit udp host PROTECTEDSERVER any eq 20 > ! deny ip any any > ! > ! > ! > interface GigabitEthernet0/2.402 > ip access-group FWCUST_XXX_OUT in > ip access-group FWCUST_XXX_IN out > ! > end > ! > > -- > Skeeve Stevens, RHCE > [EMAIL PROTECTED] / www.skeeve.org > Cell +61 (0)414 753 383 / skype://skeeve > > eintellego - [EMAIL PROTECTED] - www.eintellego.net > -- > I'm a groove licked love child king of the verse > Si vis pacem, para bellum > > > _______________________________________________ > cisco-nsp mailing list [email protected] > https://puck.nether.net/mailman/listinfo/cisco-nsp > archive at http://puck.nether.net/pipermail/cisco-nsp/ > _______________________________________________ cisco-nsp mailing list [email protected] https://puck.nether.net/mailman/listinfo/cisco-nsp archive at http://puck.nether.net/pipermail/cisco-nsp/
