Cisco – Block port with single exception on Cisco 803

aclciscorouter

This seems fairly straight forward, though I'm having trouble finding a solution on Google and in the Cisco documentation. I think I'm perhaps just not looking for the correct thing.

Essentially I want to block all outgoing SMTP traffic except for our mail server, currently only the DHCP range is blocked, but I wanted to narrow that down to just the mail server.

Current:

access-list 107 deny   tcp 10.1.3.0 0.0.0.255 any eq smtp
access-list 107 permit ip any any

I tried (but completely locked out all network connections and required a power cycle):

access-list 107 deny   tcp any any eq smtp
access-list 107 permit tcp host 10.1.1.20 any eq smtp

So, I wish to block SMTP outgoing for all hosts except 10.1.1.20, how can this be done? What am I missing?

Best Answer

Try this:

access-list 107 permit tcp host 10.1.1.20 any eq smtp
access-list 107 deny   tcp any any eq smtp
access-list 107 permit ip any any

Keep in mind, the order you insert a standard ACL in Cisco routers is the order in which the directives are matched.

So:

  1. First allow your server 10.1.1.20 to connect to smtp port
  2. Then disallow any other host to connect to smtp port
  3. Finally, allow any other IP communication
Related Topic