On the test I use the Cisco Catalyst 6509-E switch.
Suppose we need to block access to users to a certain site, a network node, or for example a social network VKontakte.
First, we know the range of IP addresses on which the site is located, for example, we search VKontakte on bgp.he.net, here is for example the list of subnets for one of the AS belonging to VKontakte “http://bgp.he.net/AS47541#_prefixes”.
And create an extended ACL for example with the name BLOCKSOCIAL:
ip access-list extended BLOCKSOCIAL deny ip any 87.240.128.0 0.0.63.255 deny ip any 93.186.224.0 0.0.7.255 deny ip any 93.186.232.0 0.0.7.255 deny ip any 95.142.192.0 0.0.15.255 deny ip any 95.213.0.0 0.0.63.255 deny ip any 185.29.130.0 0.0.0.255 deny ip any 185.32.248.0 0.0.3.255 permit ip any any exit
The rule above indicates that you want to block traffic to the specified networks coming from all (any) sources.
You can specify as a source a specific network or for example one address to deny access to another address:
deny ip host 192.168.5.1 host 192.168.11.54
The line “permit ip any any” should be necessary at the end.
Instead of a subnet mask, you need to specify the Wildcard, for example, for the mask /24, specify 0.0.0.255, for /22 – 0.0.3.255, etc., you can look at and count on any IP calculator.
/17 – 0.0.127.255
/18 – 0.0.63.255
/19 – 0.0.31.255
/20 – 0.0.15.255
/21 – 0.0.7.255
/22 – 0.0.3.255
/23 – 0.0.1.255
/24 – 0.0.0.255
If you want to block more sites, we’ll add the addresses to the same ACL, since only one can be applied to the ACL interface.
Apply the created ACL to the port looking towards the clients:
interface GigabitEthernet1/1 ip access-group BLOCKSOCIAL in
Or, to write less only to the server’s server port on the Internet, if there is one:
interface TenGigabitEthernet3/2 ip access-group BLOCKSOCIAL in
You can cancel the ACL interface as follows:
no ip access-group BLOCKSOCIAL in
Delete the ACL like this:
no ip access-list extended BLOCKSOCIAL
If you block sites on the port from the server to the clients, then in the ACL rule we will change the addresses in the following places:
ip access-list extended BLOCKSOCIAL deny ip 87.240.128.0 0.0.63.255 any deny ip 93.186.224.0 0.0.7.255 any deny ip 93.186.232.0 0.0.7.255 any deny ip 95.142.192.0 0.0.15.255 any deny ip 95.213.0.0 0.0.63.255 any deny ip 185.29.130.0 0.0.0.255 any deny ip 185.32.248.0 0.0.3.255 any deny ip host 192.168.5.1 any permit ip any any exit
See also my articles:
Blocking social networks on Mikrotik routers
Blocking social networks using iptables