Tim,
Here is the best place to get your answers:
http://www.cisco.com/univercd/cc/td/doc/product/software/ios121/121cgcr/ip_c
/ipcprt1/1cdip.htm#xtocid1702914
Everything you will need to know is there.....
Rick
----- Original Message -----
From: "Tim" <[EMAIL PROTECTED]>
To: <[EMAIL PROTECTED]>
Sent: Monday, September 03, 2001 2:28 PM
Subject: RE: [IMail Forum] Block NNTP in Cisco
> Hey that worked GREAT. Thanks.
>
> So if I wanted to block HTTP access to servers at x.x.x.x would this
work?
>
>
> Acc 101 deny tcp any x.x.x.x 255.255.255.255 eq 80
> Acc 101 permit ip any any
>
>
> Would that block all HTTP to machine at x.x.x.x and should I change the
last
> .255 to the .240 if they are on a /28 subnet?
>
> I still can't figure out why the 2 lines below to block port 119. I can
see
> what the first line does, what does the second line do?
>
> > acc 101 deny tcp any any eq 119
> > acc 101 deny tcp any eq 119 any
> acc 101 permit IP any any
>
>
> Tim D
>
>
>
>
> -----Original Message-----
> From: [EMAIL PROTECTED]
> [mailto:[EMAIL PROTECTED]]On Behalf Of Rick
> Sent: Monday, September 03, 2001 1:47 PM
> To: [EMAIL PROTECTED]
> Subject: Re: [IMail Forum] Block NNTP in Cisco
>
> you need to add another line to this. There is an implicit deny all at the
> end of all access list
> add this line:
> acc 101 permit IP any any
>
> I believe that should work for you
> Rick
>
> ----- Original Message -----
> From: "Tim" <[EMAIL PROTECTED]>
> To: "Akatosh" <[EMAIL PROTECTED]>
> Cc: "Imail" <[EMAIL PROTECTED]>
> Sent: Monday, September 03, 2001 12:18 PM
> Subject: RE: [IMail Forum] Block NNTP in Cisco
>
>
> > I tried this again but only applied it to the Ethernet interface and it
> > shuts off all ports and not just the 119 ..........on this router for
some
> > strange reason. I figured the Ethernet port was safe to test as I would
> > still be able to get to it from the outside world.
> >
> > Any ideas on this one people?
> >
> > Tim D
> >
> > -----Original Message-----
> > From: Akatosh [mailto:[EMAIL PROTECTED]]
> > Sent: Sunday, September 02, 2001 6:52 PM
> > To: Tim
> > Cc: Imail
> > Subject: Re: [IMail Forum] Block NNTP in Cisco
> >
> >
> > conf t
> > acc 101 deny tcp any any eq 119
> > acc 101 deny tcp any eq 119 any
> >
> > then apply it to an interface the person is on like this
> > int serial0/0
> > ip access-group 101 in
> >
> >
> > and there ya go, no nntp in either direction
> >
> > the syntax for that is like this
> > acc 101 [permit or deny] [ip/tcp/udp/icmp] from frommask to tomask
> >
> > eq ## can be thrown in after an address/mask to specify a port, 'any' is
a
> > shortcut for '0.0.0.0 255.255.255.255'
> >
> > search for the access-list command on cisco's website for better
> > documentation
> >
> > On Sun, 2 Sep 2001, Tim wrote:
> >
> > > Anyone know the EXACT command needed to block ALL NNTP (port 119)
access
> > to
> > > and from a network from a command prompt in a Cisco router?
> > >
> > > I have a customer who's network admin has hijacked a few of their
> servers
> > > (linux) and is using them to run a news server, ftp server and I want
to
> > > shut them off by blocking them from the router which I do have the
> proper
> > > passwords for..where I don't for the linux boxes. And, I am 1800
miles
> > away
> > > from either!
> > >
> > > Tim
> > >
> > >
> > >
> > >
> > >
> > >
> > > _______________________________________________________________
> > > Sent using Novelty Mail the FREE EMAIL SERVICE. Click here
> > http://noveltymail.com to get your own free email using this or ANY of
our
> > fun domain names.
> > >
> > > Please visit http://www.ipswitch.com/support/mailing-lists.html
> > > to be removed from this list.
> > >
> > > An Archive of this list is available at:
> > > http://www.mail-archive.com/imail_forum%40list.ipswitch.com/
> > >
> > >
> >
> > --
> > Edward Fahner
> > Systems Administrator, Planet Communications Network
> > (540)442-6677 x222 [aka. Akatosh .CU.Au, [EMAIL PROTECTED]]
> >
>
DC2.DwGmL--WT--SksCre+\Cvi+BflA(+r-v+++)N^MH+$-Fj~R+Ac+++!J+S+U-I--#V+++Q+Tc
> > ++
> >
> >
> >
> >
> >
> >
> > _______________________________________________________________
> > Sent using Novelty Mail the FREE EMAIL SERVICE. Click here
> http://noveltymail.com to get your own free email using this or ANY of our
> fun domain names.
> >
> > Please visit http://www.ipswitch.com/support/mailing-lists.html
> > to be removed from this list.
> >
> > An Archive of this list is available at:
> > http://www.mail-archive.com/imail_forum%40list.ipswitch.com/
> >
>
>
> Please visit http://www.ipswitch.com/support/mailing-lists.html
> to be removed from this list.
>
> An Archive of this list is available at:
> http://www.mail-archive.com/imail_forum%40list.ipswitch.com/
>
>
>
>
>
>
> _______________________________________________________________
> Sent using Novelty Mail the FREE EMAIL SERVICE. Click here
http://noveltymail.com to get your own free email using this or ANY of our
fun domain names.
>
> Please visit http://www.ipswitch.com/support/mailing-lists.html
> to be removed from this list.
>
> An Archive of this list is available at:
> http://www.mail-archive.com/imail_forum%40list.ipswitch.com/
>
Please visit http://www.ipswitch.com/support/mailing-lists.html
to be removed from this list.
An Archive of this list is available at:
http://www.mail-archive.com/imail_forum%40list.ipswitch.com/
