Hey that worked GREAT. Thanks.
So if I wanted to block HTTP access to servers at x.x.x.x would this work?
Acc 101 deny tcp any x.x.x.x 255.255.255.255 eq 80
Acc 101 permit ip any any
Would that block all HTTP to machine at x.x.x.x and should I change the last
.255 to the .240 if they are on a /28 subnet?
I still can't figure out why the 2 lines below to block port 119. I can see
what the first line does, what does the second line do?
> acc 101 deny tcp any any eq 119
> acc 101 deny tcp any eq 119 any
acc 101 permit IP any any
Tim D
-----Original Message-----
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED]]On Behalf Of Rick
Sent: Monday, September 03, 2001 1:47 PM
To: [EMAIL PROTECTED]
Subject: Re: [IMail Forum] Block NNTP in Cisco
you need to add another line to this. There is an implicit deny all at the
end of all access list
add this line:
acc 101 permit IP any any
I believe that should work for you
Rick
----- Original Message -----
From: "Tim" <[EMAIL PROTECTED]>
To: "Akatosh" <[EMAIL PROTECTED]>
Cc: "Imail" <[EMAIL PROTECTED]>
Sent: Monday, September 03, 2001 12:18 PM
Subject: RE: [IMail Forum] Block NNTP in Cisco
> I tried this again but only applied it to the Ethernet interface and it
> shuts off all ports and not just the 119 ..........on this router for some
> strange reason. I figured the Ethernet port was safe to test as I would
> still be able to get to it from the outside world.
>
> Any ideas on this one people?
>
> Tim D
>
> -----Original Message-----
> From: Akatosh [mailto:[EMAIL PROTECTED]]
> Sent: Sunday, September 02, 2001 6:52 PM
> To: Tim
> Cc: Imail
> Subject: Re: [IMail Forum] Block NNTP in Cisco
>
>
> conf t
> acc 101 deny tcp any any eq 119
> acc 101 deny tcp any eq 119 any
>
> then apply it to an interface the person is on like this
> int serial0/0
> ip access-group 101 in
>
>
> and there ya go, no nntp in either direction
>
> the syntax for that is like this
> acc 101 [permit or deny] [ip/tcp/udp/icmp] from frommask to tomask
>
> eq ## can be thrown in after an address/mask to specify a port, 'any' is a
> shortcut for '0.0.0.0 255.255.255.255'
>
> search for the access-list command on cisco's website for better
> documentation
>
> On Sun, 2 Sep 2001, Tim wrote:
>
> > Anyone know the EXACT command needed to block ALL NNTP (port 119) access
> to
> > and from a network from a command prompt in a Cisco router?
> >
> > I have a customer who's network admin has hijacked a few of their
servers
> > (linux) and is using them to run a news server, ftp server and I want to
> > shut them off by blocking them from the router which I do have the
proper
> > passwords for..where I don't for the linux boxes. And, I am 1800 miles
> away
> > from either!
> >
> > Tim
> >
> >
> >
> >
> >
> >
> > _______________________________________________________________
> > Sent using Novelty Mail the FREE EMAIL SERVICE. Click here
> http://noveltymail.com to get your own free email using this or ANY of our
> fun domain names.
> >
> > Please visit http://www.ipswitch.com/support/mailing-lists.html
> > to be removed from this list.
> >
> > An Archive of this list is available at:
> > http://www.mail-archive.com/imail_forum%40list.ipswitch.com/
> >
> >
>
> --
> Edward Fahner
> Systems Administrator, Planet Communications Network
> (540)442-6677 x222 [aka. Akatosh .CU.Au, [EMAIL PROTECTED]]
>
DC2.DwGmL--WT--SksCre+\Cvi+BflA(+r-v+++)N^MH+$-Fj~R+Ac+++!J+S+U-I--#V+++Q+Tc
> ++
>
>
>
>
>
>
> _______________________________________________________________
> Sent using Novelty Mail the FREE EMAIL SERVICE. Click here
http://noveltymail.com to get your own free email using this or ANY of our
fun domain names.
>
> Please visit http://www.ipswitch.com/support/mailing-lists.html
> to be removed from this list.
>
> An Archive of this list is available at:
> http://www.mail-archive.com/imail_forum%40list.ipswitch.com/
>
Please visit http://www.ipswitch.com/support/mailing-lists.html
to be removed from this list.
An Archive of this list is available at:
http://www.mail-archive.com/imail_forum%40list.ipswitch.com/
_______________________________________________________________
Sent using Novelty Mail the FREE EMAIL SERVICE. Click here http://noveltymail.com to
get your own free email using this or ANY of our fun domain names.
Please visit http://www.ipswitch.com/support/mailing-lists.html
to be removed from this list.
An Archive of this list is available at:
http://www.mail-archive.com/imail_forum%40list.ipswitch.com/
