Mate,

If you want to stop the DHCP scope address range from using port 80 (http) or 443 (https) you can use the below access list inbound on the inside interface.

access-list 111 deny tcp 10.14.84.0 0.0.3.255 any eq www

access-list 111 deny tcp 10.14.89.0 0.0.1.255 any eq www

access-list 111 deny tcp 10.14.84.0 0.0.3.255 any eq 443

access-list 111 deny tcp 10.14.89.0 0.0.1.255 any eq 443

access-list 111 permit ip any any

I think that was what you're after.. Obviously where you put the access-list largely depends on where most of the traffic will originate.

Also, as mentioned above in the previous post, you can use vlan access lists which can cull traffic even before it hits the router!

Good luck!

try to make it like this

access-list 111 deny tcp 10.14.80.0 0.0.15.255 any eq www

then apply it to the inside interface

the interface that connected to your LAN

ip access-group 111 in

you can apply it to your outside inteerface like the following but not recomended because it will be CPU intensive

on ouside interface/

ip access-group 111 out

good luck

rate if helpful

Lewis:

From a security standpoint, it is preferable to not use "permit ip any any" at the end of your interface ACLs. It is preferable to construct your interface ACLs to only allow traffic permitted by your security policy. Anything not permitted by your security policy should be denied with "deny ip any any log" at the end of your interface ACLs. You might want to transition to this methodology in future implementations.

Ideally you would prevent outbound connection initiation by applying the interface ACL on an internal interface, rather than blocking the return traffic with the interface ACL being applied to an external interface.

You DHCP Scope has been defined as: 10.14.84.1 - 10.14.89.254

The proper masking for this range would be:

10.14.84.0 0.0.3.255 (10.14.84.0 through 10.14.87.0)

10.14.88.0 0.0.1.255 (10.14.88.0 through 10.14.89.0)

Your initial post asked "How to block all the DHCP scope to access internet?", but your ACL specified the keyword "www". It is therefore not clear whether you are seeking to block all access to the Internet, or just HTTP access to the Internet for these hosts.

You've not indicated whether this router resides on your network edge, or elsewhere in your network topology. If these hosts require HTTP access to servers on your network, and the routes to those servers pass through this router, you might want to be careful of using the keyword "any" as the destination in your interface ACLs.