access lists

[carl_townshend]

When just allowing say internet traffic for my router at home out, do u just do an access list saying any any eq www, and then put an access list coming back in permitting established www connections, is this the normal way around this ?

thanks

[thomas.chen]

Do u want to allow all internet traffic from ur router and allow only established internet connections to come it?.If so, then the explanation of urs is corrrect.But remember, once u apply an access-list, there is always an implicit deny for all traffics that doesn't match the access list.

[carl_townshend]

So what is the best way to to this then ?

[Georg Pauwen]

Hello Carl,

allowing only www traffic is likely not enough, unless you have an internal DNS server. Check this access list:

access-list 101 permit tcp any any eq 443

access-list 101 permit tcp any any eq www

access-list 101 permit tcp any any eq domain

access-list 101 permit tcp any any established

This will likely serve your purpose...

HTH,

GP