Re: Help in Access-List

usman792 · ‎01-12-2006

Hi,

i want apply a access-list in my router to deny all client pc range ip address 10.1.1.11 to 10.1.1.50 any thing expecpt for UDP port permit and permit our managers pc ip addresses above this range. In my router I am using NAT and also telling me which interface I apply this access-list Ethernet or Serial

any Help is appreciated

pkhatri · ‎01-12-2006

Hi,

Try this...

access-list 101 permit ip host 10.1.1.51 any

access-list 101 permit ip 10.1.1.52 0.0.0.3 any

access-list 101 permit ip 10.1.1.56 0.0.0.7 any

access-list 101 permit ip 10.1.1.64 0.0.0.63 any

access-list 101 permit ip 10.1.1.128 0.0.0.127 any

access-list 101 permit udp 10.1.1.11 0.0.0.0 any

access-list 101 permit udp 10.1.1.12 0.0.0.3 any

access-list 101 permit udp 10.1.1.16 0.0.0.15 any

access-list 101 permit udp 10.1.1.32 0.0.0.15 any

access-list 101 permit udp 10.1.1.48 0.0.0.1 any

access-list 101 permit udp 10.1.1.50 0.0.0.0 any

access-list 101 deny ip any any

!

! apply it inbound on your ethernet interface

interface ethernet 0

ip access-group 101 in

The first 5 lines will allow full access to all source addresses in the range 10.1.1.51 upwards. The next 6 lines will allow UDP to all source addresses from 10.1.1.11 to 10.1.150. The last line will deny everything else (not strictly required as it is the default).

Hope that helps - pls rate the post if it does.

Paresh.

usman792 · ‎01-16-2006

Hi Paresh,

thanks your help but for some mistake my network range start 10.213.169.1 netmask 255.0.0.0. I want block my first 50 network address for web browseing and any messanging. they only allow for sip voice traffic means sip port 5060 and rtp port range 6000 to 15000.my all other subnet also allow for voice traffic.Is this configuration is correct for this range.

Thanks

pkhatri · ‎01-16-2006

When you say the first 50 network addresses, do you mean from 10.213.169.1 to 10.213.169.50 ?

Let me clarify your requirements:

- you want to restrict 10.213.169.1 to 10.213.169.50 so that only SIP and RTP traffic is permitted, everything else is blocked. Is that correct ?

- what traffic do you want to allow for all your other addresses ? Everything ?

Thanks,

Paresh

usman792 · ‎01-17-2006

Yes i want 10.213.169.1 to 10.213.169.50 with subnetmast 255.0.0.0 only SIP and RTP traffic permit, everything is blocke and all other ip addresses permit everything.

One more

I use NAT pool address in my router. so please give the configuration whose work in NAT.

thanks

pkhatri · ‎01-17-2006

Howdy,

It might be an idea to post your router config so that we can cover all the aspects of this config.

Paresh,

pkhatri · ‎01-17-2006

Hi again,

Try the following (it should work even if you have NAT configured);

access-list 101 permit udp 10.213.169.0 0.0.0.31 eq 5060 any

access-list 101 permit udp 10.213.169.0 0.0.0.31 any eq 5060

access-list 101 permit udp 10.213.169.32 0.0.0.15 eq 5060 any

access-list 101 permit udp 10.213.169.32 0.0.0.15 any eq 5060

access-list 101 permit udp 10.213.169.48 0.0.0.1 eq 5060 any

access-list 101 permit udp 10.213.169.48 0.0.0.1 any eq 5060

access-list 101 permit udp 10.213.169.50 0.0.0.0 eq 5060 any

access-list 101 permit udp 10.213.169.50 0.0.0.0 any eq 5060

access-list 101 permit udp 10.213.169.0 0.0.0.31 range 6000 15000 any

access-list 101 permit udp 10.213.169.0 0.0.0.31 any range 6000 15000

access-list 101 permit udp 10.213.169.32 0.0.0.15 range 6000 15000 any

access-list 101 permit udp 10.213.169.32 0.0.0.15 any range 6000 15000

access-list 101 permit udp 10.213.169.48 0.0.0.1 range 6000 15000 any

access-list 101 permit udp 10.213.169.48 0.0.0.1 any range 6000 15000

access-list 101 permit udp 10.213.169.50 0.0.0.0 range 6000 15000 any

access-list 101 permit udp 10.213.169.50 0.0.0.0 any range 6000 15000

access-list 101 deny ip 10.213.169.0 0.0.0.31 any

access-list 101 deny ip 10.213.169.32 0.0.0.15 any

access-list 101 deny ip 10.213.169.48 0.0.0.1 any

access-list 101 deny ip 10.213.169.50 0.0.0.0 any

access-list 101 permit ip any any

!

! apply it inbound on your ethernet interface

interface ethernet 0

ip access-group 101 in

Pls remember to rate posts.

Regards,

Paresh

usman792 · ‎01-17-2006

Hi,

i try these configuration they did work but one problem I use x-ten softphone with this configuration they did not work well. i use this proxy address voip-co2.teliax.com. When x-ten load they first check the ( Permorming DNS lookup then they try to registering this proxy address.

could u tell me how can i configure out these problem.

My aim is my all client PC only call they did not web surfing and any thing else. if any solution for expect router is kindly telling me.

thanks your big help

pkhatri · ‎01-17-2006

Alright, try this now - I've added the ability for DNS queries to go through. Pls remember to rate posts that help.