Cisco Access List Help

[nuttybugger]

Right, i've got to put an access list on a cisco switch at work.
The acl i have on there at the moment is blocking all traffic rather than just the traffic i want.

Its meant to only allow traffic from one pc to a proxy server on port 8080 just to surf the net. Its got a static ip address outside of the dhcp scope so dont need access to a dhcp server. And i've included access to the dns server, but the only part of the acl that gets hits is the deny all statement.

acl-public-access
deny tcp any any eq 445 #active directory
deny tcp any any eq 137 #netbios
deny tcp any any eq 138 #netbios
deny tcp any any eq 139 #netbios

permit tcp host <pc ip> any established
permit udp host <pc ip> host <dns ip> eq domain
permit udp host <pc ip> host <other dns> eq domain
permit tcp host <pc ip> host <proxy ip> eq 8080
deny ip any any

Any cisco people give any help as to why the hell this isnt working, cos i havent got a clue!

thanks

 

[nuttybugger]

yeah its set inbound on the interface. So it applies to traffic going from pc to the switch port.

about the first deny statements, they are there just for reference in case someone edits the config too much, those statements will prevent any file sharing between computers.

and i know there is an implicit deny all at the end but i've been told its always good practise to add your own, for debugging purposes ie sh ip access-list results

either way i cant test it now cos the IT tech at the other end has unplugged the pc and is off sick today....doh!

 

[nuttybugger]

well problem solved. i went to look at the pc and firstly our IT technician who had set up the pc had plugged it into the wrong switch port (possibly to get it working but who knows).
Secondly he was meant to set up the pc with a static ip address and manually set the DNS servers then freeze the config so any changes would reset with a reboot. He didnt.... the pc was frozen... but it must have been after he made any changes because they were not set when i looked at it.

The ip address and dns were both picked up from dhcp, both of which were different to the addresses i had given him and obviously wouldnt work with the access list in place.

thanks for all the help though, i changed the order a little, made it a little less restrictive and removed the denys that werent needed.