ACL allowing some traffic with DENY

Question

Good day all,
I have been trying to apply ACLs to a vlan interface and have not been able to make it work,
I configured them as follows:
Extended IP access list 160
    10 deny ip 10.0.0.0 0.0.255.255 10.0.24.0 0.0.0.255
    20 permit ip 10.0.24.0 0.0.0.255 host 8.8.8.8 log
    30 deny ip 10.0.24.0 0.0.0.255 any
    40 deny icmp 10.0.24.0 0.0.0.255 any
    50 deny ip any any
Extended IP access list 161
    10 deny ip host 4.2.2.2 10.0.24.0 0.0.0.255
    20 deny ip host w.x.y.z 10.0.24.0 0.0.0.255 - firewall outside address
    30 permit icmp host 10.0.2.3 any
    40 deny icmp any any (5 matches)
    50 deny ip any any
    60 deny udp any any
interface Vlan600
ip address 10.0.24.3 255.255.255.0
ip access-group 161 in
ip access-group 160 out
no ip route-cache cef
no ip route-cache
no ip mroute-cache
end
The problem is that i can still ping 4.2.2.2 and 8.8.8.8 which i only want to limit to 8.8.8.8. I was also able to ping yahoo.com and others The pings from the other subnets fails and any from the 24 subnet to the external address of the firewall fails which are both required results.
I tried to debug the ping test with the debug ip packet command but didnt see anything show up on my log server. I then tried the same lines in a program called acl editor simulator and it comes up as a no match. Can someone please help me figure how to block all web and 4.2.2.2 traffic in and out.
Thanks
Michael

Answer 1

Michael
It looks to me like you have your in and out reversed. VLAN 600 is subnet 10.0.24.0. In access list 160 we find that 10.0.24.x are the source addresses. So this access list should be applied as "inbound". And in access list 161 we find that references to subnet 10.0.24.0 have it as the destination, so it should be applied as "outbound".
So if you change the access-group configurations and apply 160 in and 161 out you should find more hits in the access lists.
But even if you change the direction of the access lists there will not be any successful traffic in and out of the subnet. I note that access list 160 has only a single line with a permit statement and it permits traffic to host 8.8.8.8. I also note that access list 161 has only a single line with a permit statement. And it permits only ICMP packets from host 10.0.2.3. So the amount of traffic permitted will be very small.
HTH
Rick