ACL question

[ccnguy]

Hello,

Need to stop a certain ip from getting to internet and the internet from getting to this ip.
This is what I have:

access-list 100 deny <internet ip> 0.0.0.0 <internal ip>
access-group 100 in

101 deny <internal ip> 0.0.0.0 <internet ip>
access-group 101 out

Am I barking up the right tree?

Thanks

 

[JOAMON]

Hello......

On the inside interface you could do the following:
Lets say 192.168.2.20 is the blockee

interface e0
ip access-group 100 in
ip access-group 101 out

access-list 100 deny tcp host 192.168.2.20 eq 80 any eq 80
access-list 100 permit ip any any

access-list 101 deny tcp any eq 80 host 192.168.2.20 eq 80
access-list 101 permit ip any any

Also....put access-list in place first and then apply to the interface so as to not kill access to the router via telnet.

The above will only block

http://www traffic

and allow all other traffic. You want to be sepcific so that still has access to the network but is blocked from the web.