ACL: block a single host
- Security
- Beginner
- 10 min
- 4 steps
- Cisco IOS-style
Configure a standard ACL on R2 that blocks traffic from H1 but permits H3, apply it inbound on R2's Gi0/0, and verify with pings.
Open this lab in your browser →
Free · no install · no account
Scenario
Standard ACLs filter on source IP only. They should be applied "as close to the destination as possible" (extended ACLs go the other way). The implicit final entry is always deny ip any any, so add a permit any to allow anything not explicitly blocked.
Topology
1 × switch, 3 × router · Cisco IOS-style
HUB— switchH1— routerR2— routerH3— router
What you will do
On R2, create ACL 10 with two entries:
deny host 10.0.0.1, thenpermit any.Apply ACL 10 inbound on R2.Gi0/0 (
ip access-group 10 in).Confirm H3 → R2 works. Ping from H3 to 10.0.0.2.
Confirm H1 → R2 is dropped. Ping from H1 to 10.0.0.2 — fails.
Open this lab in your browser →
More labs on this topic
- ACL: named extended — proto + src + dstIntermediate · 12 min
- Extended ACL — port range matchersIntermediate · 7 min
- Extended ACL with
object-group networkIntermediate · 10 min - ACL — time-gated entries with
time-rangeIntermediate · 12 min
This lab in other languages
ACL: einen einzelnen Host blockierenACL: bloquear un solo hostACL: bloqueando um único hostACL : bloquer un hôte uniqueACL: एक होस्ट को ब्लॉक करेंACL：阻止单台主机ACL: blocca un singolo hostACL: 単一ホストをブロックACL: 단일 호스트 차단ACL: блокировать одного хостаACL: tek bir hostu engelleACL: chặn một host duy nhất