Trouble with Ip redirect

Question

I am having a bit of trouble with ip redirects on an airnet 1042N
Here is what happens, I turn off ip redirect, everything works fine, turn it on, everything works fine.  The problem is when I apply an ACL to it.
If I apply an ACL, I can ping web sites, but I can not browse websites or telnet to port 80.  This is simply a test configuration before I move it into production.  10.0.0.0/22 is our subnet.  I want the guest ssid to allow access to the internet, but not the the internal network (with the exception of the gateway (10.0.1.254) , dhcp, and dns servers (same server 10.0.1.221)
Running config
Current configuration : 2475 bytes
version 12.4
no service pad
service timestamps debug datetime msec
service timestamps log datetime msec
service password-encryption
hostname testap
logging rate-limit console 9
enable secret 5 $1$PBvp$dH8HqNdXBTP7eCzYanRRo.
no aaa new-model
dot11 syslog
dot11 ssid main
   authentication open
   authentication key-management wpa version 2
   wpa-psk ascii 7 1234567890abcdefghi
   ip redirection host 10.0.1.254 access-group 102 in
dot11 ssid secondary
   authentication open
   authentication key-management wpa version 2
   guest-mode
   wpa-psk ascii 7 075E731F1A5C4F524F4B5B0D06292F212E343D2B
   ip redirection host 10.0.1.254 access-group 103 in
username Cisco password 7 01300F175804
bridge irb
interface Dot11Radio0
no ip address
no ip route-cache
encryption mode ciphers aes-ccm
ssid main
ssid secondary
antenna gain 0
station-role root
bridge-group 1
bridge-group 1 subscriber-loop-control
bridge-group 1 block-unknown-source
no bridge-group 1 source-learning
no bridge-group 1 unicast-flooding
bridge-group 1 spanning-disabled
interface Dot11Radio1
no ip address
no ip route-cache
shutdown
antenna gain 0
dfs band 3 block
channel dfs
station-role root
bridge-group 1
bridge-group 1 subscriber-loop-control
bridge-group 1 block-unknown-source
no bridge-group 1 source-learning
no bridge-group 1 unicast-flooding
bridge-group 1 spanning-disabled
interface GigabitEthernet0
ip address 10.0.2.150 255.255.252.0
no ip route-cache
duplex auto
speed auto
no keepalive
bridge-group 1
no bridge-group 1 source-learning
bridge-group 1 spanning-disabled
interface BVI1
ip address 10.0.2.150 255.255.252.0
no ip route-cache
ip http server
no ip http secure-server
ip http help-path http://www.cisco.com/warp/public/779/smbiz/prodconfig/help/eag
access-list 101 permit ip any host 10.0.1.254
access-list 101 permit ip any host 10.0.1.221
access-list 101 deny   ip 10.0.0.0 0.0.3.255 10.0.0.0 0.0.3.255
access-list 101 permit ip any any
access-list 102 permit ip any 10.0.0.0 0.0.3.255
access-list 103 permit 80 any any
access-list 103 permit ip any host 10.0.1.254
access-list 103 permit ip any host 10.0.1.221
access-list 103 deny   ip 10.0.0.0 0.0.3.255 10.0.0.0 0.0.3.255
access-list 103 permit ip any any
access-list 120 permit ip host 10.0.3.41 any
access-list 120 permit ip any host 10.0.3.41
bridge 1 route ip
line con 0
logging synchronous
line vty 0 4
login local
end

Answer 1

James:
Welcome to the forum.
To enable both encrypted and unencrypted traffic on same radio you need to use VLANs. If you are using only the native VLAN then you are abide by only one encryption method for all SSIDs.
Check this for multiple SSIDs and multiple VLANs:
https://supportforums.cisco.com/docs/DOC-14496
For your network above, you should review the ACL and make sure it allows the needed traffic. Make sure both ports 80 and 23 are opened. Make sure to choose correct ports (udp, tcp) on the ACL.
You can also try configuring ip redirect from GUI. give a look to the ip redirect doc: http://tiny.cc/gdsekw.
HTH
Amjad
Rating useful replies is more useful than saying "Thank you"