Try to block a user from the inside to an IP on the out side.
I entered the following line
access-list PUBLIC_DMZ extended deny tcp host 172.16.100.22 255.255.255.255 69.63.186.36
I want to block them on all ports
This Question has been solved and asker verified All Experts Exchange premium technology solutions are available to subscription members.
Experts Exchange has been collecting answers to technology questions since 1996…3 million and counting! If you have a question, chances are we already have your answer.
If you can't find the exact answer you're looking for, ask our exclusive community of 50,000 experts. You’ll get a personalized answer from a trusted professional.
Thousands of free tech tips, tricks, how-to’s and tutorials are available in our peer reviewed articles section. See for yourself how smart our experts are, no login required.
Save solutions to your questions, answers you’ve discovered through searching plus helpful articles in your personal knowledgebase for easy future access.
Access the answers to your technology questions today.
30-day free trial. Register in 60 seconds.
Members of the expert community talk about why the experience at Experts Exchange is different than what you will find anywhere else.
Try it out and discover for yourself.
30-day free trial. Register in 60 seconds.
Join the community of experts here and help other tech pros by answering question in your area of expertise. You can earn FREE access to all Experts Exchange's premium features and resources.
However if the user is tech savvy they can get roung it you are better just blocking facebook alltogether
regex facebook1 "facebook\.com"
class-map type inspect http match-any block-url-class
match request uri regex facebook1
policy-map type inspect http block-url-policy
parameters
class block-url-class
drop-connection log
policy-map global_policy
class inspection_default
inspect http block-url-policy
service-po
Ref: http://serverfault.com/que
Not able to block facebook to everyone due to academic freedom on our network. They arent very tech savy plus it needs to be done on a host by host basises which will seperate their computers from lets say a lab computer.
But thank you for the above answer I might be doing some other stuff in the future.
So was my line wrong?
no your line was OK - but you were only blocking TCP - then you asked how to block all ports - I answered by changing the ACL to IP before I realised it was for facebook. Your command is fine - providing it has a matching access-group command
ie
access-group PUBLIC_DMZ in interface DMZ <<< if thats the inteface the traffic is going out through
A more elegant solution would be to create some groups then you can add IP addresses without it getting to complicated i.e
name 69.63.186.36 Facebook
name 172.16.100.22 Blocked_Client1
object-group network Blocked_Sites
network-object Facebook 255.255.255.255
object-grou
network-object Blocked_Client1 255.255.255.255
access-list
Then as you identify new IP addresses just add them to the relavant groups :)
PL
Make a dns host file on the machine in question,
it will take precedence over the dns server
http://vlaurie.com/compute
do that with the bad ip referral recommendation, in the intended users machine
honestly, is this a company?
You probably cannot block access to a social networking site for one person, instead of all, there could be legal grounds for discussion here
Jfer
here's the easy solution
from
http://www.secretgeek.net/
In order to delete Facebook, i opened this file:
C:\WINDOWS\system32\driver
and I added this line:
0.0.0.0 www.facebook.com
Jfer
Business Accounts
Answer for Membership
by: PeteLongPosted on 2009-09-25 at 08:49:51ID: 25424232
access-list PUBLIC_DMZ extended deny ip host 172.16.100.22 255.255.255.255 69.63.186.36