Configure the access list for the AR series router package filter control

Configure the AR series router package filter to control the access list [requirement] 1. do not restrict access to the Internet from the Intranet Address 192.168.1.0/25. 2. Only emails can be sent and received from the Intranet address 192.168.1.128/25, do not allow access to the Internet [configure Scripts] configure scripts # sysname routings # firewall enable/enable firewall function/firewall default deny/configure the default firewall operation as deny/# radius scheme system # domain system # acl number 2000/define the ACL for NAT translation/rule 0 permit source 192.168.1.0 0.0.0.255rule 1 deny # acl number 3001/define the ACL for packet filtering/rule 0 permit ip source 192.168.1.0 0.0.0.127/ intranet Address 192.168.1.0/25 outside access No network restrictions/rule 1 permit tcp source 192.168.1.128 0.0.127 destination-port eq pop3rule 2 permit tcp source 192.168.1.128 0.0.127 destination-port eq smtp/Intranet address 192.168.1.128/25 can only send and receive emails/# interface ethernet1/0/0ip address 192.168.1.1 255.255.255.0firewall packet-filter 3001 inbound/filter inbound traffic packets/# interface serial/0/0link-protocol pppip address 202.101.1.2 255.255.255.252nat outbound 2000 # interface NU LL0 # ip route-static 0.0.0.0 0.0.0.0 202.101.1.1 preference 60 # user-interface con 0user-interface vty 0 4 # return [verification] Check whether the firewall is effective by checking disp firewall-statistics all and disp acl 3001. <rouyun> disp firewall-statistics allFirewall is enable, default filtering method is deny. interface: Ethernet1/0/0In-bound Policy: acl 3001 Fragments matched normallyFrom 5:05:50 to 6: 32: 49198 packets, 24129 B Ytes, 4% permitted, 0 packets, 0 bytes, 0% denied, 0 packets, 0 bytes, 0% permitted default, 5919 packets, 1021492 bytes, 96% denied default, Totally 198 packets, 24129 bytes, 4% permitted, Totally 5919 packets, 1021492 bytes, 96% denied. <RouterA> disp acl 3001 Advanced ACL 3001, 3 rulesAcls step is 1 rule 0 permit ip source 192.168.1.0 0.0.127 (194 times matched) rule 1 permit tcp source 192.168.1.128 0.0.0.127 destination-port eq pop3 (9 times matched) rule 2 permit tcp source 192.168.1.128 0.0.0.127 destination-port eq smtp (0 times matched) tip: 1. firewall disable by default ), use the "firewall enable" command to enable the firewall function. 2. The default firewall filtering method is allow (permit ), you can use "firewall default deny" to change it to "forbidden". 3. Use package filtering on the Intranet and use the DHCP server to allocate addresses at the same time, you must add a "rule 0 permit ip source 0.0.0.0 0" in acl 3001. Otherwise, the DHCP Server cannot allocate an address.