Arrrgghhh!!! Some ACL assistance needed!

[CyBeRkId2002]

We are looking at setting up an Access Control List for the first time on our network as we are soon to allow guest access on our WiFi. Try as I might I can't get it to do what I want/need.

 

We are trying to stop anyone on the guest Vlan (13 - 10.58.173.1/24) from accessing anything on the main college Vlan (1 - 10.58.160.1/23), whilst still being able to access the router (10.58.160.1). I have thought about this logically and come up with the following ACL but it just doesnt seem to work. Any guidance would be greatly appreciated!

 

Access-list 100 permit tcp 10.58.173.0 0.0.0.255 host 10.58.160.1 ***should allow access to our router***

Access-list 100 permit tcp 10.58.173.0 0.0.0.255 host 10.58.160.41 ***should allow access to DNS - will lock this down further to port once we have it working***

Access-list 100 deny tcp 10.58.173.0 0.0.0.255 10.58.160.1 0.0.3.255 ***should block anything else in the core network range***

Access-list 100 permit tcp any any ***should allow anything else***

 

We then applied this to the Guest Vlan as an outgoing access group.

 

Can anyone see where we are going wrong?

Edited January 13, 2016 by CyBeRkId2002

[CyBeRkId2002]

Sorted! Needed to be an IN access group, not an out. Won't even pretend to understand why, just glad it is working now!