Hi All,
This is my first time on Cisco support. We have a number of customers that use Cisco 800 series routers as internet gateways/firewall. I had to work on a few of them and found an ACL config that I believe to be insecure (see below). Just to be sure I would like to ask an expert if it is secure or not.
This ACL is applied to the outside interface facing the Internet.
Extended IP access list 103
10 deny ip any host 255.255.255.255
20 permit ip any any
Outside interface
Ip access-group 103 in
My concern is the second ACL statement, permit ip any any. I believe this was created to allow all the static nat statements, but will this not make the router vulnerable to attacks? Would it be more secure to individually allow the necessary traffic through instead of allowing all traffic? See the more detailed config below.
interface ATM0
no ip address
no ip route-cache cef
no ip route-cache
no ip mroute-cache
no atm ilmi-keepalive
pvc 0/33
encapsulation aal5mux ppp dialer
dialer pool-member 1
!
dsl operating-mode auto
!
interface FastEthernet0
!
interface FastEthernet1
!
interface FastEthernet2
!
interface FastEthernet3
!
interface Vlan1
ip address 192.168.1.254 255.255.255.0
no ip redirects
no ip proxy-arp
ip nat inside
ip virtual-reassembly
ip tcp adjust-mss 1452
load-interval 30
hold-queue 100 out
!
interface Vlan2
description WLAN-GASTEN
no ip address
!
interface Dialer0
ip address 1.1.1.1 255.255.255.248
ip access-group 103 in
no ip redirects
no ip proxy-arp
ip nat outside
ip virtual-reassembly
encapsulation ppp
dialer pool 1
dialer-group 1
no cdp enable
ppp authentication pap callin
ppp pap sent-username xxxx password xxxxxx
!
ip forward-protocol nd
ip route 0.0.0.0 0.0.0.0 Dialer0
!
ip http server
ip http secure-server
ip nat inside source list 101 interface Dialer0 overload
ip nat inside source static tcp 192.168.1.23 1062 1.1.1.1 1062 extendable
ip nat inside source static tcp 192.168.1.5 25 1.1.1.2 25 extendable
ip nat inside source static tcp 192.168.1.5 110 1.1.1.2 110 extendable
ip nat inside source static tcp 192.168.1.2 442 1.1.1.2 442 extendable
ip nat inside source static tcp 192.168.1.5 443 1.1.1.2 443 extendable
ip nat inside source static tcp 192.168.1.6 444 1.1.1.2 444 extendable
ip nat inside source static tcp 192.168.1.5 987 1.1.1.2 987 extendable
ip nat inside source static tcp 192.168.1.5 1723 1.1.1.2 1723 extendable
ip nat inside source static tcp 192.168.1.5 3389 1.1.1.2 3389 extendable
ip nat inside source static tcp 192.168.1.14 80 1.1.1.3 80 extendable
ip nat inside source static tcp 192.168.1.14 443 1.1.1.3 443 extendable
ip nat inside source static tcp 192.168.1.14 3389 1.1.1.3 3389 extendable
!
access-list 1 permit any
access-list 23 permit 192.168.1.0 0.0.0.255
access-list 23 permit 3.3.3.3 0.0.0.63
access-list 23 permit 4.4.4.4 0.0.0.31
access-list 23 permit 85.5.5.5 0.0.0.63
access-list 101 permit ip 192.168.1.0 0.0.0.255 any
access-list 103 remark Traffic allowed to enter the router from Internet
access-list 103 deny ip any host 255.255.255.255
access-list 103 permit ip any any
dialer-list 1 protocol ip permit
control-plane
!
!
line con 0
login local
no modem enable
line aux 0
line vty 0 4
access-class 23 in
privilege level 15
password xxxxx
login local
transport input telnet ssh
Thanks in advance for any help.
