Current configuration : 4043 bytes
!
version 12.4
service timestamps debug datetime msec
service timestamps log datetime msec
no service password-encryption
!
hostname test
!
boot-start-marker
boot-end-marker
!
!
no aaa new-model
!
resource policy
!
memory-size iomem 5
mmi polling-interval 60
no mmi auto-configure
no mmi pvc
mmi snmp-timeout 180
ip subnet-zero
ip cef
!
!
!
ip domain name xxxx.it
ip name-server 212.216.112.122
!
!
interface Null0
no ip unreachables
!
!
enable password xxxx
!
!
crypto isakmp policy 20
encr 3des
authentication pre-share
group 2
crypto isakmp key 123456 address 89.97.xxx.xx
!
!
crypto ipsec transform-set myset esp-3des esp-sha-hmac
!
crypto map mymap 10 ipsec-isakmp
set peer 89.97.xxx.xxx
set security-association lifetime kilobytes 86400
set security-association lifetime seconds 28800
set transform-set myset
match address 101
!
!
!
interface FastEthernet0/0
description *** lan inside ***
ip address 192.168.16.201 255.255.255.0
ip access-group 110 in
ip nat inside
no ip virtual-reassembly
duplex auto
speed auto
!
interface FastEthernet0/1
description *** Wan point-point ***
ip address 217.24.xxx.xxx 255.255.255.252
ip verify unicast reverse-path
no ip redirects
no ip unreachables
no ip proxy-arp
ip accounting access-violations
ip nat outside
ip virtual-reassembly
ip tcp adjust-mss 1412
duplex auto
speed auto
no cdp enable
no mop enabled
crypto map mymap
!
ip classless
ip route 0.0.0.0 0.0.0.0 217.24.xxx.xxx
!
ip http server
no ip http secure-server
ip nat inside source list 102 interface FastEthernet0/1 overload
!
no access-list 100
no access-list 102
no access-list 101
no access-list 110
no access-list 120
access-list 101 remark
access-list 101 permit ip 192.168.16.0 0.0.0.255 192.168.4.0 0.0.3.255
access-list 102 deny ip 192.168.16.0 0.0.0.255 192.168.4.0 0.0.3.255
access-list 103 deny ip 192.168.16.0 0.0.0.255 host www.facebook.it
access-list 103 deny ip 192.168.16.0 0.0.0.255 host www.facebook.com
access-list 103 deny ip 192.168.16.0 0.0.0.255 host www.facebook.co.uk
access-list 103 deny ip 192.168.16.0 0.0.0.255 host www.youporn.com
access-list 103 deny ip 192.168.16.0 0.0.0.255 host www.redtube.com
access-list 103 deny ip 192.168.16.0 0.0.0.255 host www.youtube.it
access-list 103 deny ip 192.168.16.0 0.0.0.255 host www.youtube.com
access-list 103 permit icmp any host 192.168.16.201 echo-reply
access-list 103 permit icmp any host 192.168.16.201 time-exceeded
access-list 103 permit icmp any host 192.168.16.201 unreachable
access-list 103 deny ip 10.0.0.0 0.255.255.255 any
access-list 103 deny ip 172.16.0.0 0.15.255.255 any
access-list 103 deny ip 127.0.0.0 0.255.255.255 any
access-list 103 deny ip host 255.255.255.255 any
access-list 103 deny ip host 0.0.0.0 any
access-list 103 permit ip 192.168.16.0 0.0.0.255 any
access-list 103 deny ip any any
!
!
control-plane
!
!
line con 0
line aux 0
line vty 0 5
password test
login
!
!
end
mi spiegate una cosina ma se io volessi bloccare i siti che ho messo nelle ACL 103 la devo applicare all'interfaccia interna giusto ?
Io ho provato si in che out solo che mi si blocca tutto
ma dov'è che sbaglio ?
Grazie
mi spiegate una cosa please
Moderatore: Federico.Lagni
-
lorbellu
- Network Emperor
- Messaggi: 313
- Iscritto il: gio 25 ott , 2007 6:14 pm
ti si blocca tutto perchè con l'ultima riga (che comunque sarebbe immessa di default), blocchi il traffico di ritorno da any all'interfaccia esterna che usi per il NAT.
Comunque se vuoi bloccare l'accesso a questi siti non basta mettere una ACL, questo perchè le ACL filtrano gli IP e quindi, quando specifich:
i
Questo va bene per indirizzi fissi ma non per servizi web con indirizzi piuttosto "mutanti", ovvero siti che cambiano spesso IP.
Per bloccare qeusti accessi, usa una service policy basata sull'individuazione della stringa nelle pagine web (non negli URL).
E' una cosa che si può normalmente fare, ovviamente più sono i siti da bloccare, più CPU utilizzerai.
Saluti
Comunque se vuoi bloccare l'accesso a questi siti non basta mettere una ACL, questo perchè le ACL filtrano gli IP e quindi, quando specifich:
i
In realtà il router risolve al DNS il sito che blocchi e ti ritrovi una riga di ACL tipo:access-list 103 deny ip 192.168.16.0 0.0.0.255 host www.facebook.it
Codice: Seleziona tutto
access-list 103 deny ip 192.168.16.0 0.0.0.255 host X.X.X.XPer bloccare qeusti accessi, usa una service policy basata sull'individuazione della stringa nelle pagine web (non negli URL).
E' una cosa che si può normalmente fare, ovviamente più sono i siti da bloccare, più CPU utilizzerai.
Saluti
Lorbellu
-
valerio1976
- Network Emperor
- Messaggi: 263
- Iscritto il: ven 05 mar , 2010 9:05 am
lorbellu ha scritto:ti si blocca tutto perchè con l'ultima riga (che comunque sarebbe immessa di default), blocchi il traffico di ritorno da any all'interfaccia esterna che usi per il NAT.
Comunque se vuoi bloccare l'accesso a questi siti non basta mettere una ACL, questo perchè le ACL filtrano gli IP e quindi, quando specifich:
iIn realtà il router risolve al DNS il sito che blocchi e ti ritrovi una riga di ACL tipo:access-list 103 deny ip 192.168.16.0 0.0.0.255 host www.facebook.itQuesto va bene per indirizzi fissi ma non per servizi web con indirizzi piuttosto "mutanti", ovvero siti che cambiano spesso IP.Codice: Seleziona tutto
access-list 103 deny ip 192.168.16.0 0.0.0.255 host X.X.X.X
Per bloccare qeusti accessi, usa una service policy basata sull'individuazione della stringa nelle pagine web (non negli URL).
E' una cosa che si può normalmente fare, ovviamente più sono i siti da bloccare, più CPU utilizzerai.
Saluti
GRAZIE
))ciao
-
valerio1976
- Network Emperor
- Messaggi: 263
- Iscritto il: ven 05 mar , 2010 9:05 am
Current configuration : 4043 bytes
!
version 12.4
service timestamps debug datetime msec
service timestamps log datetime msec
no service password-encryption
!
hostname test
!
boot-start-marker
boot-end-marker
!
!
no aaa new-model
!
resource policy
!
memory-size iomem 5
mmi polling-interval 60
no mmi auto-configure
no mmi pvc
mmi snmp-timeout 180
ip subnet-zero
ip cef
!
!
!
ip domain name test
ip name-server 192.168.4.32
!
!
class-map match-any ADULT-URL
match protocol http url "*porn*"
match protocol http url "*porn"
match protocol http url "porn*"
match protocol http url ".*xxx*."
match protocol http url ".xxx*."
match protocol http url ".*xxx."
match protocol http url "*social network*"
match protocol http url "*facebook*"
match protocol http url "*youtube*"
!
!
policy-map FILTER-ADULT
class ADULT-URL
set ip dscp 5
!
!
!
!
!
interface Null0
no ip unreachables
!
!
enable password valerio1
!
!
crypto isakmp policy 20
encr 3des
authentication pre-share
group 2
crypto isakmp key 1234 address 89.97.xxx.xyz
!
!
crypto ipsec transform-set myset esp-3des esp-sha-hmac
!
crypto map mymap 10 ipsec-isakmp
set peer 89.97.186.132
set security-association lifetime kilobytes 86400
set security-association lifetime seconds 28800
set transform-set myset
match address 101
!
!
!
interface FastEthernet0/0
description *** lan inside ***
ip address 192.168.16.201 255.255.255.0
ip policy route-map deny-adult
ip nat inside
no ip virtual-reassembly
duplex auto
speed auto
service-policy input FILTER-ADULT
!
interface FastEthernet0/1
description *** Wan point-point ***
ip address 217.24.xxx.xxx 255.255.255.252
ip verify unicast reverse-path
no ip redirects
no ip unreachables
no ip proxy-arp
ip accounting access-violations
ip nat outside
ip virtual-reassembly
ip tcp adjust-mss 1412
duplex auto
speed auto
no cdp enable
no mop enabled
crypto map mymap
!
ip classless
ip route 0.0.0.0 0.0.0.0 217.24.xxx.xxx
!
no ip http server
no ip http secure-server
ip nat inside source list 102 interface FastEthernet0/1 overload
!
access-list 101 permit ip 192.168.16.0 0.0.0.255 192.168.4.0 0.0.3.255
access-list 102 permit ip 192.168.16.0 0.0.0.255 192.168.4.0 0.0.3.255
access-list 102 deny ip 192.168.16.0 0.0.0.255 192.168.4.0 0.0.3.255
access-list 150 permit ip any any dscp 5
access-list 150 deny ip any any
!
!
route-map DENY-ADULT permit 10
match ip address 150
set interface Null0
control-plane
!
banner motd ^C
****************************************************************
----------------------------------------------------------------
* *** ROUTER PERIMETRALE *** *
----------------------------------------------------------------
* WARNING: System is RESTRICTED to authorized personnel ONLY! *
* Unauthorized use of this system will be logged and *
* prosecuted to the fullest extent of the law. *
* *
* If you are NOT authorized to use this system, LOG OFF NOW! *
* *
*************************************************************** ^C
!
line con 0
line aux 0
line vty 0 5
password valerio
login
!
!
end
!
version 12.4
service timestamps debug datetime msec
service timestamps log datetime msec
no service password-encryption
!
hostname test
!
boot-start-marker
boot-end-marker
!
!
no aaa new-model
!
resource policy
!
memory-size iomem 5
mmi polling-interval 60
no mmi auto-configure
no mmi pvc
mmi snmp-timeout 180
ip subnet-zero
ip cef
!
!
!
ip domain name test
ip name-server 192.168.4.32
!
!
class-map match-any ADULT-URL
match protocol http url "*porn*"
match protocol http url "*porn"
match protocol http url "porn*"
match protocol http url ".*xxx*."
match protocol http url ".xxx*."
match protocol http url ".*xxx."
match protocol http url "*social network*"
match protocol http url "*facebook*"
match protocol http url "*youtube*"
!
!
policy-map FILTER-ADULT
class ADULT-URL
set ip dscp 5
!
!
!
!
!
interface Null0
no ip unreachables
!
!
enable password valerio1
!
!
crypto isakmp policy 20
encr 3des
authentication pre-share
group 2
crypto isakmp key 1234 address 89.97.xxx.xyz
!
!
crypto ipsec transform-set myset esp-3des esp-sha-hmac
!
crypto map mymap 10 ipsec-isakmp
set peer 89.97.186.132
set security-association lifetime kilobytes 86400
set security-association lifetime seconds 28800
set transform-set myset
match address 101
!
!
!
interface FastEthernet0/0
description *** lan inside ***
ip address 192.168.16.201 255.255.255.0
ip policy route-map deny-adult
ip nat inside
no ip virtual-reassembly
duplex auto
speed auto
service-policy input FILTER-ADULT
!
interface FastEthernet0/1
description *** Wan point-point ***
ip address 217.24.xxx.xxx 255.255.255.252
ip verify unicast reverse-path
no ip redirects
no ip unreachables
no ip proxy-arp
ip accounting access-violations
ip nat outside
ip virtual-reassembly
ip tcp adjust-mss 1412
duplex auto
speed auto
no cdp enable
no mop enabled
crypto map mymap
!
ip classless
ip route 0.0.0.0 0.0.0.0 217.24.xxx.xxx
!
no ip http server
no ip http secure-server
ip nat inside source list 102 interface FastEthernet0/1 overload
!
access-list 101 permit ip 192.168.16.0 0.0.0.255 192.168.4.0 0.0.3.255
access-list 102 permit ip 192.168.16.0 0.0.0.255 192.168.4.0 0.0.3.255
access-list 102 deny ip 192.168.16.0 0.0.0.255 192.168.4.0 0.0.3.255
access-list 150 permit ip any any dscp 5
access-list 150 deny ip any any
!
!
route-map DENY-ADULT permit 10
match ip address 150
set interface Null0
control-plane
!
banner motd ^C
****************************************************************
----------------------------------------------------------------
* *** ROUTER PERIMETRALE *** *
----------------------------------------------------------------
* WARNING: System is RESTRICTED to authorized personnel ONLY! *
* Unauthorized use of this system will be logged and *
* prosecuted to the fullest extent of the law. *
* *
* If you are NOT authorized to use this system, LOG OFF NOW! *
* *
*************************************************************** ^C
!
line con 0
line aux 0
line vty 0 5
password valerio
login
!
!
end
