- For individual users
- Instant access to solutions
- Ask your tech questions
- Start your 30-day Free Trial
Main Topics
Browse All TopicsI have a Cisco 2621 and I'm trying to get a few things working on a router/network that I play around on.
First, I'm trying to connect to a Battlefield 2 online server. I know the problem in somewhere in my access list, 'InternetIn'. When I add 'permit ip any any', the game will see all servers no problem. But that's not how I want to handle it. After I did that I went to GRC.com, did a stealth check and it was able to see all ports. I don't want that. I'd rather close every port not needed. But the problem is I can't figure out how to make it work with 'deny ip any any'. How can I modify my access list to make it work while being as stealthy/secure as possible? Also, can someone help streamline my access-list if I have useless stuff in there?
Second, I have several machines connected to this same router. But I want to give the gaming machines priority [high], web servers priority [medium], internet surfing machines [normal], etc... So I setup priority-list 1 default high and access-list 1 with only one machines ip address '192.168.100.44'. Will this machine have priority over the rest? Do I have the right idea here, or should I change something around? Maybe an example of different machines with different prioritys...
Hopefully next week, I'll get around to installing the advanced security IOS. Can someone point me in the right direction for settings I should look into?
Here is the config:
**************************
Building configuration...
Current configuration : 4463 bytes
!
version 12.3
service timestamps debug datetime msec
service timestamps log datetime msec
service password-encryption
!
hostname 2600
!
boot-start-marker
boot-end-marker
!
enable password ********************
!
no network-clock-participate slot 1
no network-clock-participate wic 0
no aaa new-model
ip subnet-zero
no ip source-route
ip cef
!
!
!
no ip domain lookup
no ftp-server write-enable
!
!
!
!
interface Loopback0
description NAT to Internet
ip address ***.***.***.113 255.255.255.248
!
interface FastEthernet0/0
ip address 192.168.100.1 255.255.255.0
ip nat inside
duplex auto
speed auto
!
interface Serial0/0
description Internet T1
ip address ***.***.***.158 255.255.255.252
ip access-group InternetIn in
ip nat outside
no ip route-cache cef
ip route-cache flow
no ip mroute-cache
priority-group 3
!
interface FastEthernet0/1
description Link to 207
ip address 192.168.207.1 255.255.255.0
ip nat inside
duplex auto
speed auto
!
interface Serial0/1
ip address 192.168.0.1 255.255.255.252
ip nat inside
!
interface Serial0/2
ip address 192.168.0.9 255.255.255.252
ip nat inside
**************** interfaces cut ****************
!
ip nat inside source list 120 interface Serial0/0 overload
ip nat inside source static 192.168.100.10 ***.***.***.115
ip nat inside source static 192.168.100.9 ***.***.***.114
ip nat inside source static 192.168.100.20 ***.***.***.118
ip nat inside source static 192.168.100.18 ***.***.***.117
ip classless
ip route 0.0.0.0 0.0.0.0 ***.***.***.157
ip route 192.168.1.0 255.255.255.0 192.168.100.3
ip route 192.168.201.0 255.255.255.0 192.168.0.2
ip route 192.168.203.0 255.255.255.0 192.168.0.10
**************** ip route to interfaces cut ****************
no ip http server
!
ip access-list extended InternetIn
permit tcp any any established
permit icmp any any echo-reply
permit icmp any any traceroute
permit icmp any any unreachable
permit icmp any any time-exceeded
permit udp any eq domain any
permit tcp any eq domain any
deny ip 127.0.0.0 0.255.255.255 any
deny ip 224.0.0.0 31.255.255.255 any
permit tcp host ***.***.***.*** host ***.***.***.114 eq 3389
permit tcp host ***.***.***.*** host ***.***.***.114 eq 3389
permit tcp any host ***.***.***.118 eq www
permit tcp any any eq pop3
permit tcp any any eq 1080
permit tcp any any eq 1088
permit tcp any any eq 1100
permit tcp any any eq 1101
permit udp any any eq 1100
permit udp any any eq 1101
permit udp any any eq 443
permit udp any any eq 1200
permit tcp any any eq www
permit tcp any any eq 443
permit tcp any any eq 4711
permit tcp any any eq 17475
permit tcp any any eq 18000
permit tcp any any eq 18300
permit tcp any any eq 18510
permit tcp any any eq 28910
permit tcp any any eq 29900
permit tcp any any eq 29901
permit tcp any any range 1024 1124
permit udp any any eq 16567
permit udp any any eq 18000
permit udp any any eq 18300
permit udp any any eq 27900
permit udp any any eq 27901
permit udp any any eq 28910
permit udp any any eq 29900
permit udp any any range 1024 1124
permit udp any any range 1500 4999
permit udp any any range 55123 55125
permit ip any any
!
access-list 1 permit 192.168.100.44
access-list 3 deny 192.168.100.44
access-list 3 permit any
access-list 120 permit ip 192.168.0.0 0.0.255.255 any
priority-list 1 default high
snmp-server community public RO
snmp-server enable traps tty
!
line con 0
line aux 0
line vty 0 4
password 7 *****************
login
!
!
!
end
2600#exit
**************************
Here is the sh ver:
**************************
Cisco Internetwork Operating System Software
IOS (tm) C2600 Software (C2600-IPBASE-M), Version 12.3(6f), RELEASE SOFTWARE (fc
1)
Copyright (c) 1986-2005 by cisco Systems, Inc.
Compiled Tue 16-Aug-05 17:54 by ssearch
Image text-base: 0x80008098, data-base: 0x80ED16A0
ROM: System Bootstrap, Version 12.2(8r) [cmong 8r], RELEASE SOFTWARE (fc1)
2600 uptime is 23 weeks, 6 days, 0 minutes
System returned to ROM by reload
System image file is "flash:c2600-ipbase-mz.123
cisco 2621XM (MPC860P) processor (revision 0x401) with 125952K/5120K bytes of me
mory.
Processor board ID FTX1014A1UF (1100307982)
M860 processor: part number 5, mask 2
Bridging software.
X.25 software, Version 3.0.0.
2 FastEthernet/IEEE 802.3 interface(s)
1 Serial network interface(s)
6 Serial(sync/async) network interface(s)
32K bytes of non-volatile configuration memory.
32768K bytes of processor board System flash (Read/Write)
Configuration register is 0x2102
**************************
Thanks!
This question has been solved and asker verified All Experts Exchange premium technology solutions are available to subscription members.
Experts Exchange has been collecting answers to technology questions since 1996…3 million and counting! If you have a question, chances are we already have your answer.
If you can't find the exact answer you're looking for, ask our exclusive community of 50,000 experts. You’ll get a personalized answer from a trusted professional.
Thousands of free tech tips, tricks, how-to’s and tutorials are available in our peer reviewed articles section. See for yourself how smart our experts are, no login required.
Access the answers to your technology questions today.
30-day free trial. Register in 60 seconds.
Members of the expert community talk about why the experience at Experts Exchange is different than what you will find anywhere else.

Try it out and discover for yourself.
30-day free trial. Register in 60 seconds.
Join the community of experts here and help other tech pros by answering question in your area of expertise. You can earn FREE access to all Experts Exchange's premium features and resources.
Business Accounts
Answer for Membership