ACL e Tunnel su SOHO 97

[visc@]

ciao,
ho implementato il Tunnel GRE tra la mia sede ed un'altra sede remota.
adesso vorrei implementare delle ACL per "bloccare " eventuale traffico indesiderato sia in che out e consentire l'accesso sulle porte 3389 e 5800 da OUT solo dalle seguenti reti:
xxx.xx.144.0/24
xxx.xx.148.0/25
xxx.xxx.132.0/22
potete darmi qualche indicazione per favore?!

posto la config attuale....

interface Loopback0
ip address xx.xx.xx.251 255.255.255.248
!
interface Tunnel0
ip address 192.168.111.249 255.255.255.252
tunnel source xx.xx.xx.251
tunnel destination 151.xx.xx.242
!
interface Ethernet0
ip address 10.xx.xx.65 255.255.255.192
ip helper-address 10.xx.xx.64
ip nat inside
no keepalive
hold-queue 100 out
!
interface ATM0
no ip address
no atm ilmi-keepalive
dsl operating-mode auto
dsl power-cutback 0
!
interface ATM0.1 point-to-point
ip address yyy.yy.yy.yy 255.255.255.252
ip nat outside
pvc 8/35
encapsulation aal5snap
!
!
ip nat pool aeris xx.xx.xx.249 xx.xx.xx.249 netmask 255.255.255.248
ip nat inside source list 102 pool aeris overload
ip nat inside source static tcp 10.xx.xx.66 3389 interface Tunnel0 3389
ip nat inside source static tcp 10.xx.xx.66 5900 interface Tunnel0 5900
ip nat inside source static tcp 10.xx.xx.64 4100 10.xx.134.0 4100 extendable
ip nat inside source static 10.xx.xx.66 xx.xx.xx.250 extendable
ip classless
ip route 0.0.0.0 0.0.0.0 ATM0.1
ip route xx.xx.134.0 255.255.254.0 Tunnel0
ip route xx.xx.164.64 255.255.255.224 Tunnel0
ip http server
!
access-list 102 permit ip 192.168.1.0 0.0.0.255 any
access-list 102 permit ip 10.xx.105.0 0.0.0.64 any
access-list 102 permit ip 10.xx.105.0 0.0.0.255 any
access-list 103 deny ip host 10.xx.xx.64 host 0.0.0.66
access-list 103 deny ip 10.xx.xx.64 0.0.0.63 10.xxx.164.64 0.0.0.31
access-list 103 deny ip 10.xx.xx.64 0.0.0.63 10.xx.xx.0 0.0.1.255
access-list 103 permit ip 10.xx.105.0 0.0.0.64 any

[Rizio]

Ti basta creare un'acl ed applicarla al tunnel (o all'interfaccia che vuoi proteggere).
Es.

Codice: Seleziona tutto

ip access-l ext RDP-VNC
permit tcp xxx.xx.144.0 0.0.0.255 192.168.111.249 0.0.0.3 eq 3389
permit tcp xxx.xx.144.0 0.0.0.255 192.168.111.249 0.0.0.3 eq 5800
[...etc etc etc...]
!
!
int tu 0
 ip access-g RDP-VNC in

Se non ho scritto putt...cavolate dovrebbe essere sufficiente così.

Rizio