A named extended ACL for a guest LAN, and a standard ACL that blocked everyone

Steps

1. Place the devices and cable them as the Topology lists. Use the automatic connection type (the lightning-bolt cable) for every link, so Packet Tracer picks straight-through or cross-over for you. Give the PCs and servers their addresses and gateways in Desktop > IP Configuration, and set PC2's DNS Server to 172.16.60.80. On SRV2, open Services > DNS, set it On, and add an A Record with Name www.example.com and Address 172.16.60.80. Its HTTP service is already on.
2. Configure R1's three interfaces and its routes to the two server LANs:

Router> enable
Router# configure terminal
Router(config)# hostname R1
R1(config)# interface GigabitEthernet0/0/0
R1(config-if)# ip address 192.168.22.1 255.255.255.0
R1(config-if)# no shutdown
R1(config-if)# interface GigabitEthernet0/0/1
R1(config-if)# ip address 192.168.50.1 255.255.255.0
R1(config-if)# no shutdown
R1(config-if)# interface GigabitEthernet0/0/2
R1(config-if)# ip address 192.168.12.1 255.255.255.252
R1(config-if)# no shutdown
R1(config-if)# exit
R1(config)# ip route 10.5.5.0 255.255.255.0 192.168.12.2
R1(config)# ip route 172.16.60.0 255.255.255.0 192.168.12.2

3. Configure R2 the same way, with routes back to the two LANs behind R1:

Router> enable
Router# configure terminal
Router(config)# hostname R2
R2(config)# interface GigabitEthernet0/0/2
R2(config-if)# ip address 192.168.12.2 255.255.255.252
R2(config-if)# no shutdown
R2(config-if)# interface GigabitEthernet0/0/0
R2(config-if)# ip address 10.5.5.1 255.255.255.0
R2(config-if)# no shutdown
R2(config-if)# interface GigabitEthernet0/0/1
R2(config-if)# ip address 172.16.60.1 255.255.255.0
R2(config-if)# no shutdown
R2(config-if)# exit
R2(config)# ip route 192.168.22.0 255.255.255.0 192.168.12.1
R2(config)# ip route 192.168.50.0 255.255.255.0 192.168.12.1

Before any ACL, everything is open: from PC2, C:\> ping 10.5.5.10 and C:\> ping 172.16.60.80 both get replies. 4. Write the guest ACL. It depends on destinations and ports, so it is extended, and it goes inbound on the interface facing the guests, near the source. The specific deny comes first; DNS is permitted, or no web name would resolve:

R1(config)# ip access-list extended GUEST-IN
R1(config-ext-nacl)# remark Guests: DNS and web only, no internal servers
R1(config-ext-nacl)# 10 deny ip 192.168.50.0 0.0.0.255 10.0.0.0 0.255.255.255
R1(config-ext-nacl)# 20 permit udp 192.168.50.0 0.0.0.255 any eq 53
R1(config-ext-nacl)# 30 permit tcp 192.168.50.0 0.0.0.255 any eq 80
R1(config-ext-nacl)# 40 permit tcp 192.168.50.0 0.0.0.255 any eq 443
R1(config-ext-nacl)# exit
R1(config)# interface GigabitEthernet0/0/1
R1(config-if)# ip access-group GUEST-IN in
R1(config-if)# end

5. Test as a guest on PC2. In Desktop > Web Browser, http://www.example.com loads (entries 20 and 30). Then:

C:\> ping 10.5.5.10
C:\> ping 172.16.60.80

Both pings fail. The first hits entry 10. The second hits no entry at all, because nothing permits ICMP: that is the implicit deny at the end of every ACL. From PC1 on the staff LAN, both pings still get replies, because the ACL sits only on the guest interface. Now read the counters with R1# show access-lists GUEST-IN: entries 10, 20 and 30 show matches, and entry 40 has none, because nobody used HTTPS. 6. The help desk wants guests to be able to ping the web server, and nothing else new. Insert an entry between 20 and 30 by giving it a sequence number; typed without one, it would land at the end as entry 50:

R1# configure terminal
R1(config)# ip access-list extended GUEST-IN
R1(config-ext-nacl)# 25 permit icmp 192.168.50.0 0.0.0.255 host 172.16.60.80
R1(config-ext-nacl)# end
R1# show access-lists GUEST-IN

Entry 25 sits between 20 and 30. From PC2, ping 172.16.60.80 now gets replies, and ping 10.5.5.10 still fails at entry 10. 7. Break it with a standard ACL. The aim is to keep the guest LAN out of the internal server LAN as a second layer. A standard ACL sees only the source, so it goes near the destination, outbound on R2's interface facing 10.5.5.0/24. Type only the deny:

R2# configure terminal
R2(config)# access-list 15 deny 192.168.50.0 0.0.0.255
R2(config)# interface GigabitEthernet0/0/0
R2(config-if)# ip access-group 15 out
R2(config-if)# end

From PC1, C:\> ping 10.5.5.10 now fails, although PC1 is staff and the only entry names the guest subnet. R2# show access-lists 15 explains it: the one entry shows no matches for PC1's packets, because they match nothing written, and the invisible deny any at the end drops them. 8. Fix it with a permit after the deny, then test again:

R2# configure terminal
R2(config)# access-list 15 permit any
R2(config)# end

From PC1, ping 10.5.5.10 gets replies again. Guests stay blocked: at R1 by GUEST-IN entry 10, and here by entry 10 of list 15 if anything ever got past R1.