Acl

hypnotoad

Trying to set up a wireless hotspot where users can get on the internet but access nothing (or hardly nothing) on the local LAN.

ACL to be applied on WAP to cut a path to what the wireless PC can access.

PC = 10.10.49.35 /22
AP = 10.10.48.10 /22
Gateway = 10.10.48.1 /22

permit ip 10.10.48.10 255.255.255.255 (so it can talk to it's AP if needed)
permit ip 10.10.48.1 255.255.255.255 (so it can talk to it's Gateway if needed)
permit ip 10.10.0.215 255.255.255.255 (an internal server that is OK to access)
deny ip 10.10.0.0 0.0.255.255 (cut out the rest of the LAN)
permit ip any any (allow any other connections -- i.e. internet).

Any ideas on why this would allow too much? I.e. I can still ping 10.10.0.216, even though it's supposed to only allow 3 internal devices, the internet, and deny all other LAN.

TIA.

blackninja

hypnotoad wrote: »

Trying to set up a wireless hotspot where users can get on the internet but access nothing (or hardly nothing) on the local LAN.

ACL to be applied on WAP to cut a path to what the wireless PC can access.

PC = 10.10.49.35 /22
AP = 10.10.48.10 /22
Gateway = 10.10.48.1 /22

permit ip 10.10.48.10 255.255.255.255 (so it can talk to it's AP if needed)
permit ip 10.10.48.1 255.255.255.255 (so it can talk to it's Gateway if needed)
permit ip 10.10.0.215 255.255.255.255 (an internal server that is OK to access)
deny ip 10.10.0.0 0.0.255.255 (cut out the rest of the LAN)
permit ip any any (allow any other connections -- i.e. internet).

Any ideas on why this would allow too much? I.e. I can still ping 10.10.0.216, even though it's supposed to only allow 3 internal devices, the internet, and deny all other LAN.

TIA.

Am i right in saying that the 255.255.255.255. be replaced with 0.0.0.0 as a single host

As the all 255s are allowing any thing through?