🚀 go-pugleaf

Tried replying by mail, but my mailer doesn't like
ugly.NoSubdomain.NoDomain.  You're still running with the default as
shipped mail config, aren't you?  Tsk tsk.  Nevermind, here goes...

In article <1992Aug6.234311.2529@ncube.com> zod@NoDomain.NoSubdomain.ugly 
writes:
>Well it's time again for another access-list question.
>
>I have got 4 interfaces into my cisco. 2 ethernet and 2
>serial. My local net is on one ethernet and internet goes
>to one serial interface. I am trying to set the access-list
>so that ip connection is allowed to 2 hosts from outside and
>ip connection be allowed from all hosts inside. I have tried
>setting access-group 101 for the ethernet interface and using:
>
>access-list 101 permit ip 0.0.0.0 255.255.255.255 nnn.nnn.nnn.13 0.0.0.255
>access-list 101 permit ip 0.0.0.0 255.255.255.255 nnn.nnn.nnn.47 0.0.0.255
>access-list 101 permit ip nnn.nnn.nnn.0 0.0.0.255 0.0.0.0 255.255.255.255
>access-list 101 deny ip 0.0.0.0 255.255.255.255 nnn.nnn.nnn.0 0.0.0.255
>
>Where nnn is my network numbers.
>
>This scheme doesn't work, and any connection is being allowed into my net!
>Am I missing something here? Or do I need to get new firmware for my cisco?
> My show version shows:

Assuming that the above is accurate, I reckon the problem is in your
first two access-list statements, which should read:

access-list 101 permit ip 0.0.0.0 255.255.255.255 nnn.nnn.nnn.13 0.0.0.0
access-list 101 permit ip 0.0.0.0 255.255.255.255 nnn.nnn.nnn.47 0.0.0.0
                                                                      ^^
Even though you've specified hosts .13 and .47, that .255 in the
statements as you quoted them means that the Cisco is supposed to
ignore that component of the address, so effectively BOTH those first
two statements say 'let anyone connect to any of our hosts'.

-- 
Paul Smee, Computing Service, University of Bristol, Bristol BS8 1UD, UK
 P.Smee@bristol.ac.uk - ..!uunet!uknet!bsmail!p.smee - Tel +44 272 303132