access-list at serial0 inbound traffic not working

[Edward999]

Hi I have a problems with my access-list at my cisco router.

Below is my router configuration:

interface FastEthernet0
ip address xxx.xxx.xxx.xxx 255.255.255.0
ip nat inside
speed auto
!
interface Serial0
description "Serial Link to ISP"
bandwidth 512
ip address yyy.yyy.yyy.yyy 255.255.255.252
ip access-group 102 in
ip nat outside
encapsulation ppp
!
router rip
version 2
passive-interface Serial0
network zz.0.0.0
network xxx.xxx.xxx.0
no auto-summary
!
!
ip nat pool alpine-natpool-0 aaa.aaa.aaa.bbb aaa.aaa.aaa.ccc netmask 255.255.255.224
ip nat inside source list 1 pool alpine-natpool-0 overload
ip nat inside source static 193.161.1.20 aaa.aaa.aaa.cc
ip classless
ip route 0.0.0.0 0.0.0.0 Serial0
no ip http server
!
!
access-list 1 permit any
access-list 102 permit tcp 220.1.1.192 0.0.0.31 host yyy.yyy.yyy.yyy eq telnet
access-list 102 permit tcp 220.1.1.192 0.0.0.31 host aaa.aaa.aaa.ddd
access-list 102 permit ip any any
end

My Static NAT to 193.161.1.20 working fine. My router located at my branch office and i accessing my server 193.161.1.20 through port 80 http at my HQ office. I can access my server 193.161.1.20.

My access-list was trying to allow only on my HQ valid IP which is 220.1.1.192 to access my server 193.161.1.20.

My access-list not working because i can use dail up internet to access my server 193.161.1.20.

Why i cannot allow only my HQ valid IP to access the server?
I already permit the access-list but still allow other IP address to access my server 193.161.1.20.

Please help...thanks for any reply

 

[Edward999]

oops...sorry the Ip address aaa.aaa.aaa.cc and aaa.aaa.aaa.ddd is the same

Sorry...thx

 

[ChrisAC]

"access-list 102 permit tcp 220.1.1.192 0.0.0.31 host aaa.aaa.aaa.ddd"

when using 'tcp' or 'udp' in an access list you are supposed to define a port number.

"access-list 102 permit ip any any"

Not much point in having an access list and then allowing all traffic.

"My access-list not working because i can use dail up internet to access my server 193.161.1.20."

This is because your access list allows "ip any any". You are basically saying;

Allow 220.1.1.192 0.0.0.31
Also allow everything else.

Chris.

**********************
Chris A.C, CCNA, CCSA
**********************

 

[Edward999]

Yes you are right chrisAC. Thanks for your reply. I appreciate it.

Thanks again.