Yeah that wasn't mentioned in anything that I could find on the web. Very
confusing deal.
Any idea why this won't block port 80 to machine x.x.x.x ? The port 119
part works but I can't seem to shut down the http port and I am not sure why
it takes the 2 commands to block the 119 but I know that part does work.
That was courtesy of someone here in the forum.
acc 101 deny tcp any any eq 119
acc 101 deny tcp any eq 119 any
acc 101 deny tcp 0.0.0.0 255.255.255.255 63.144.218.219 0.0.0.0 eq 80
acc 101 deny tcp 0.0.0.0 255.255.255.255 63.144.218.222 0.0.0.0 eq 80
acc 101 permit IP any any
Tim D
-----Original Message-----
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED]]On Behalf Of Madscientist
Sent: Monday, September 03, 2001 12:08 PM
To: [EMAIL PROTECTED]
Subject: RE: [IMail Forum] Block NNTP in Cisco
I think you forgot about the implicit deny rule.
Anything not specifically granted is denied when an access list is defined.
Hope this helps,
_M
| -----Original Message-----
| From: [EMAIL PROTECTED]
| [mailto:[EMAIL PROTECTED]]On Behalf Of Tim
| Sent: Monday, September 03, 2001 12:20 PM
| To: Akatosh
| Cc: Imail
| Subject: RE: [IMail Forum] Block NNTP in Cisco
|
|
|
| Ok, well I did this and locked myself out of the router totally.
| I applied
| it to both the serial and the Ethernet ports and as soon as I hit enter,
| bam, I was blocked. I guess it didn't see the eq 119 part. I'm afraid to
| try it again!
|
| Any ideas on why it would not see the port 119 part of the
| command? I guess
| I will have to find the archives for any other answers to my
| question as it
| has been down since I made my attempt. :)
|
| Tim
|
|
| conf t
| acc 101 deny tcp any any eq 119
| acc 101 deny tcp any eq 119 any
|
| then apply it to an interface the person is on like this
| int serial0/0
| ip access-group 101 in
|
|
| and there ya go, no nntp in either direction
|
| the syntax for that is like this
| acc 101 [permit or deny] [ip/tcp/udp/icmp] from frommask to tomask
|
| eq ## can be thrown in after an address/mask to specify a port, 'any' is a
| shortcut for '0.0.0.0 255.255.255.255'
|
| search for the access-list command on cisco's website for better
| documentation
|
| On Sun, 2 Sep 2001, Tim wrote:
|
| > Anyone know the EXACT command needed to block ALL NNTP (port 119) access
| to
| > and from a network from a command prompt in a Cisco router?
| >
| > I have a customer who's network admin has hijacked a few of
| their servers
| > (linux) and is using them to run a news server, ftp server and I want to
| > shut them off by blocking them from the router which I do have
| the proper
| > passwords for..where I don't for the linux boxes. And, I am 1800 miles
| away
| > from either!
| >
| > Tim
| >
| >
| >
| >
| >
| >
| > _______________________________________________________________
| > Sent using Novelty Mail the FREE EMAIL SERVICE. Click here
| http://noveltymail.com to get your own free email using this or ANY of our
| fun domain names.
| >
| > Please visit http://www.ipswitch.com/support/mailing-lists.html
| > to be removed from this list.
| >
| > An Archive of this list is available at:
| > http://www.mail-archive.com/imail_forum%40list.ipswitch.com/
| >
| >
|
| --
| Edward Fahner
| Systems Administrator, Planet Communications Network
| (540)442-6677 x222 [aka. Akatosh .CU.Au, [EMAIL PROTECTED]]
| DC2.DwGmL--WT--SksCre+\Cvi+BflA(+r-v+++)N^MH+$-Fj~R+Ac+++!J+S+U-I-
| -#V+++Q+Tc
| ++
|
|
|
|
|
|
| _______________________________________________________________
| Sent using Novelty Mail the FREE EMAIL SERVICE. Click here
http://noveltymail.com to get your own free email using this or ANY of our
fun domain names.
Please visit http://www.ipswitch.com/support/mailing-lists.html
to be removed from this list.
An Archive of this list is available at:
http://www.mail-archive.com/imail_forum%40list.ipswitch.com/
Please visit http://www.ipswitch.com/support/mailing-lists.html
to be removed from this list.
An Archive of this list is available at:
http://www.mail-archive.com/imail_forum%40list.ipswitch.com/
_______________________________________________________________
Sent using Novelty Mail the FREE EMAIL SERVICE. Click here http://noveltymail.com to
get your own free email using this or ANY of our fun domain names.
Please visit http://www.ipswitch.com/support/mailing-lists.html
to be removed from this list.
An Archive of this list is available at:
http://www.mail-archive.com/imail_forum%40list.ipswitch.com/
