🚀 go-pugleaf

In article <1992Aug6.234311.2529@ncube.com> zod@ugly.NoSubdomain.NoDomain (Operator) writes:
>access-list 101 permit ip 0.0.0.0 255.255.255.255 nnn.nnn.nnn.13 0.0.0.255
>access-list 101 permit ip 0.0.0.0 255.255.255.255 nnn.nnn.nnn.47 0.0.0.255
>access-list 101 permit ip nnn.nnn.nnn.0 0.0.0.255 0.0.0.0 255.255.255.255
>access-list 101 deny ip 0.0.0.0 255.255.255.255 nnn.nnn.nnn.0 0.0.0.255

Paul Smee already provided one correction.  I wanted to point out that this
still won't do what you want.  After making that fix, you won't be able to
make any outgoing connections from hosts other that .13 and .47.  The
problem is that you're putting your restrictions at the wrong level of the
protocol stack.  You're prohibiting all packets that come from the Internet
to your net (except to those two hosts), and this includes the replies to
your outgoing connections.

If you want to allow outgoing TCP connections you'll have to put the
restrictions at the tcp level, and then make decisions based on port
numbers.

If you can upgrade to a more recent cisco release, you can use the
"established" criterion on TCP access lists, which recognizes incoming
packets on an outgoing connection.  But note that some protocols such as
rsh and ftp make use of both an outgoing and incoming connection.
-- 
Barry Margolin
System Manager, Thinking Machines Corp.

barmar@think.com          {uunet,harvard}!think!barmar