ACL Help - 1721 - Restricting Indiv. IP's Outbound

[jlancton]

Hello,

I need to restrict access TO the Internet for individual users. What commands do I put in the ACL to block an individual IP from getting to the net, but allow them access to local network resources?

Thanks!!

-Jeff

 

[Cluebird]

access-list 151 permit ip host h.h.h.h x.x.x.x w.w.w.w
access-list 151 deny ip any any

On the interface:
access-group 151 in

Use your network address and wildcard mask for the x.x.x.x and w.w.w.w. Remember, you can deny by not permitting so in this case permitting traffic only to your network will deny traffic to the net.

HTH

 

[jlancton]

So instead of permitting all hosts out and denying a specific one, we should deny all and permit specific ones... Do I understand correctly?

Thanks!

-Jeff

 

[Cluebird]

That is correct.

 

[lgarner]

Normally, yes. But if you want to block a specific IP, and you know that address won't change (it's a server, or the user can't change it), then I'd block it only. It's always a good idea to permit only your network outbound, though.

access-list 101 deny ip host x.x.x.x any
access-list 101 permit ip <lan_net> <lan_mask> any
access-list 101 deny ip any any

The "deny ip any any" is optional, but I like to include it as a reminder.

Depending upon your topology, it might more sense to apply this to the external i/f as an outbound ACL.