no access-list 101
!
!
! *** EXTERNAL STAFF ***
!
!
! Bill at home
access-list 101 permit ip 111.111.70.80 0.0.0.15 any
!
! Ed at home
access-list 101 permit ip 111.111.70.192 0.0.0.31 any
!
! Grand Junction "Internal" network
access-list 101 permit ip 111.111.75.0 0.0.0.255 any
!
!
! Allow everything to dave
! NOTE: Knock Knock Knock!
! Who is it?
! It's me, Dave, man. Open up, I got the stuff.
! Dave's not here.
!access-list 101 permit ip any 206.212.111.0 0.0.1.255
!
!access-list 101 permit ip any 206.212.111.0 0.0.1.255
!
!
! Block ssh access to 222.222.2.0/24 and 222.222.5.0/25
! while allowing access to 222.222.2.22 and 222.222.2.70
!
access-list 101 permit tcp any host 222.222.2.22 eq 22
access-list 101 permit tcp any host 222.222.2.70 eq 22
access-list 101 deny tcp any 222.222.2.0 0.0.0.255 eq 22 log
access-list 101 deny tcp any 222.222.5.0 0.0.0.127 eq 22 log
!
!
! *** SERVICES ***
!
!
! Block access to the tftp on 222.222.2.70 from outside the network
! while allowing access for the Grand Junction networks.
!
access-list 101 permit udp any 99.99.99.0 0.0.31.255 eq 69
access-list 101 deny udp any host 222.222.2.70 eq 69
!
! Block external access to platypus daemons on the 222.222.2.0/24 network
access-list 101 deny tcp any 222.222.2.0 0.0.0.255 eq 5124
!
! Block external access to dumptruck
access-list 101 deny ip any host 222.222.2.222
access-list 101 deny ip any host 222.222.2.223
!
! Block external access to the ethernet switches
!
access-list 101 deny ip any host 222.222.2.3
access-list 101 deny ip any host 222.222.5.254
access-list 101 deny ip any host 222.222.24.4
!
! Block syslog
! NOTE: This needs to be reconsidered as we may have
! customers who have external machines that log
! to machines on this side of the router.
access-list 101 deny udp any any eq syslog
!
!
! *** MS Blaster ***
!
!
! Network wide block for MS Blaster - Port 4444
access-list 101 deny tcp any any eq 4444
!
! Block MS Blaster port 135 only on selected networks.
! NOTE: This is selective because it is denying access
! for customers who run Microsoft Exchange Server.
!
! Block MS Blaster on the Dialup Pools
!
access-list 101 deny tcp any 222.222.52.0 0.0.0.255 eq 135
access-list 101 deny tcp any 222.222.53.0 0.0.0.255 eq 135
access-list 101 deny udp any 222.222.52.0 0.0.0.255 eq 135
access-list 101 deny udp any 222.222.53.0 0.0.0.255 eq 135
!
!
! *** OTHER FILTERS ***
!
!
! Network wide blocks for backup exec bugs
access-list 101 deny tcp any any eq 10000
access-list 101 deny udp any any eq 10000
!
! Test for Cisco exploits
! NOTE: This really should be reconsidered as the remaining
! routers and switches have long been updated.
access-list 101 deny 53 any 222.222.0.0 0.0.0.255
access-list 101 deny 55 any 222.222.0.0 0.0.0.255
access-list 101 deny 77 any 222.222.0.0 0.0.0.255
access-list 101 deny 103 any 222.222.0.0 0.0.0.255
!
access-list 101 deny 53 any 222.222.1.0 0.0.0.255
access-list 101 deny 55 any 222.222.1.0 0.0.0.255
access-list 101 deny 77 any 222.222.1.0 0.0.0.255
access-list 101 deny 103 any 222.222.1.0 0.0.0.255
!
!
! Deny packets from Martian IP's
!
access-list 101 deny ip 0.0.0.0 0.0.0.0 any
access-list 101 deny ip 0.0.0.0 0.255.255.255 any
access-list 101 deny ip 127.0.0.0 0.255.255.255 any
access-list 101 deny ip 128.0.0.0 0.0.255.255 any
access-list 101 deny ip 191.255.0.0 0.0.255.255 any
access-list 101 deny ip 223.255.255.0 0.0.0.255 any
access-list 101 deny ip 224.0.0.0 0.255.255.255 any
access-list 101 deny ip 240.0.0.0 15.255.255.255 any
access-list 101 deny ip 255.255.255.255 0.0.0.0 any
!
! Deny packets from RFC 1597 blocks
!
access-list 101 deny ip 172.16.0.0 0.15.255.255 any
access-list 101 deny ip 192.168.0.0 0.0.255.255 any
!
! allow anything else
access-list 101 permit ip any any
!
end