Let replies in, keep new connections out
The edge ACL lets internal hosts browse out, but it also lets the internet open new connections inward. Restrict the inbound filter to established return traffic only.
Scenario
The edge router filters traffic coming in from the internet with the ACL EDGE. Inside hosts
(10.0.1.0/24) should be able to browse out and receive the replies, but the outside should not
be able to open new connections to them. Right now the inbound ACL permits any TCP, so the internet
can reach inside hosts directly.
Your job
In rtr/rtr.conf, change the inbound ACL so it only permits TCP that is part of an already-open
connection (the established keyword), i.e. replies to sessions the inside started, and denies new
inbound connections.
What "done" looks like
The inbound ACL permits tcp ... established (return traffic) and implicitly denies new inbound TCP;
inside hosts can still initiate outbound connections.
Teaches: a stateless approximation of stateful filtering:
permit tcp ... establishedlets in only packets that acknowledge an existing connection, so replies return while unsolicited inbound is dropped.
What gets checked
Your solution is verified against each of these:
- Return traffic for connections the inside started is allowed back in
- A new, unsolicited connection from the outside is denied
- Inside hosts can still initiate outbound connections
Solve it in your browser
No setup, no install. Write your solution in the editor and hit Check. The in-house engine renders and grades it instantly, then issues your proof the moment every check passes.
Solve in browser →Prefer your own lab?
- Build the fix locally. New to the tooling? See setting up your lab.
- Push your topology file, device configs, and any playbooks to a public repo (GitHub or GitLab).
- Submit the repo link. We review it by hand, confirm it works, and issue your proof page.