Hi,
I have a Cisco 806 Router w/ IOS 12.2. I am going to have it sit on my test network as the gateway to the internet, e1 being the internet side and e0 being the LAN side, my question is this:
I would like to create an access list that denies everything except for 1 port # (ssh port 22) coming from a specific IP address, I want to block all other incoming traffic and log all attempts to gain access to my router, would I use an extended access list for this? any if so what would be the syntax?
I also would need to create a Static NAT mapping to send the SSH request to the correct machine, this is what I have for that:
ip nat inside source static tcp 192.168.10.1 22 <Public IP address used for inside services> 22 extendable
Is this correct?
Thank You
This Question has been solved and asker verified All Experts Exchange premium technology solutions are available to subscription members.
Experts Exchange has been collecting answers to technology questions since 1996…3 million and counting! If you have a question, chances are we already have your answer.
If you can't find the exact answer you're looking for, ask our exclusive community of 50,000 experts. You’ll get a personalized answer from a trusted professional.
Thousands of free tech tips, tricks, how-to’s and tutorials are available in our peer reviewed articles section. See for yourself how smart our experts are, no login required.
Save solutions to your questions, answers you’ve discovered through searching plus helpful articles in your personal knowledgebase for easy future access.
Access the answers to your technology questions today.
30-day free trial. Register in 60 seconds.
Members of the expert community talk about why the experience at Experts Exchange is different than what you will find anywhere else.
Try it out and discover for yourself.
30-day free trial. Register in 60 seconds.
Join the community of experts here and help other tech pros by answering question in your area of expertise. You can earn FREE access to all Experts Exchange's premium features and resources.
You can limit access to the virtual terminals directly with a standard access list like so,
access-list 11 permit 192.168.10.1
line vty 0 4
806(config-line)#
access-class 11 in
This way you can still ssh through the router from your internal network to an outbound (Internet) host.
Limit connections to the virtual terminals to ssh by applying the following to the vty's,
transport input ssh
Tech3463
No comment has been added lately (36 days), so it's time to clean up this TA.
I will leave a recommendation in the Cleanup topic area for this question:
RECOMMENDATION: Points awarded to: lrmoore
Experts, please leave any comments here within 7 days.
--------------------------
PLEASE DO NOT ACCEPT THIS COMMENT AS AN ANSWER!
--------------------------
Thanks,
lrmoore
EE Cleanup Volunteer
---------------------
If you feel that your question was not properly addressed, or that none of the comments received were appropriate answers, please post
comments here
Business Accounts
Answer for Membership
by: lrmoorePosted on 2003-07-06 at 20:37:30ID: 8866544
The static nat map looks fine. Since SSH can use both TCP and UDP on port 22, you might want to add a second acl line for udp nat:
ip nat inside source static udp 192.168.10.1 22 <Public IP address used for inside services> 22
As for an inbound acl:
# permit SSh from only one host to one host:
access-list 123 permit tcp host <host IP> host <public IP> eq 22
access-list 123 permit udp host <host IP> host <public IP> eq 22
# If you leave it at that, you'll now block all inbound traffic that is a response to outbound requests, so you have to compensate:
access-list 123 permit tcp any any established
access-list 123 permit udp any any eq 53
#
# I always put in a last line with "log" so that I can see everything that is blocked (your requirement to log all attempts:
access-list 123 deny ip any any log
No just apply the acl inbound on the external interface...