Request: How to allow VLAN1 (eg, Internal Network) access to VLAN10 (eg, CCTV Network & PCs), but VLAN10 unable to access VLAN1

Hi, I would like to configure 1 way access for VLAN1 to VLAN10, but not allow VLAN10 to access to VLAN1.
Please advise what configuration needed in console?

Switch Model: Ruijie RG-CS83-24GT4XS (Layer 3 Switch)

VLAN1 = 192.168.11.0 (Internal Network)
VLAN10 (port 1) = 192.168.10.0 (CCTV Network & PCs)

Port 1: VLAN10 - Access mode (DHCP Client:192.168.10.2)
Port 9: VLAN1 - Access mode (DHCP Client: 192.168.11.2)

permit VLAN1 (192.168.11.0) to access VLAN10 (192.168.10.0)
deny VLAN10 (192.168.10.0) to access VLAN11 (192.168.11.0)

I tried to configure script as below,  but nothing work (even VLAN1 IP trying to ping VLAN10 IP from PC, it shows Request timed out. Remote Access attempt also failed)

conf ter
ip access-list extended vlan10
10 permit ip 192.168.11.0 0.0.0.255 192.168.10.0 0.0.0.255
20 deny ip 192.168.10.0 0.0.0.255 192.168.11.0 0.0.0.255
30 permit ip any any
exit

int g0/1
ip access-group vlan10 in
end
wr

Thank you.

From Jim

Hello sir, plz try this one
conf ter
ip access-list extended vlan10
10 deny ip 192.168.10.0 0.0.0.255 192.168.11.0 0.0.0.255
20 permit ip any any
exit
int g0/1
ip access-group vlan10 out
end
wr

GTAC-Stella replied at 2024-3-22 11:51
Hello sir, plz try this one
conf ter
ip access-list extended vlan10

Hi Stella,

Thank for replying my post.

I have followed your step but unfortunately it does not work as it should be.
In your suggested configuration, I can manage to PING and Remote Access from VLAN1 to VLAN10,
however the VLAN10 PC can both PING and Remote my Own PC as well...

Jim Khor replied at 2024-3-22 12:11
Hi Stella,

Thank for replying my post.

Dear sir

You can only block one-way ping via the followng commands:
conf ter
ip access-list extended vlan10
10 deny icmp 192.168.10.0 0.0.0.255 192.168.11.0 0.0.0.255 echo  -->deny the icmp echo packets from vlan10 to vlan11 traffic

20 permit ip any any
exit
Then you can apply the ACL list to the specific interface to test again. The above ACL list indicates that it only blocks icmp echo packets from vlan10 to vlan11, but icmp reply packets are not blocked. So only vlan11 can not access vlan10 network, but vlan10 can still access vlan11 network actively.


Best regards
Jenny

俞佳敏1 replied at 2024-3-22 13:45
Dear sir

You can only block one-way ping via the followng commands:

Dear Jenny,

conf ter

ip access-list extended vlan10

10 deny icmp 192.168.10.0 0.0.0.255 192.168.11.0 0.0.0.255 echo  -->deny the icmp echo packets from vlan10 to vlan11 traffic

20 permit ip any any

exit


Please advise what does the "but icmp reply packets are not blocked" mean?

I configured your given settings, ECHO not working from VLAN10 to VLAN1, but VLAN10 PC can still able to Remote Access the PC from VLAN1.
What command I need to get rid of it?
Thanks.

Jim Khor replied at 2024-3-22 16:49
Dear Jenny,

conf ter

ping packets are divided into icmp echo and icmp reply

no 10 deny icmp 192.168.10.0 0.0.0.255 192.168.11.0 0.0.0.255 echo > this for delete

GTAC-Micca replied at 2024-3-22 19:42
ping packets are divided into icmp echo and icmp reply

no 10 deny icmp 192.168.10.0 0.0.0.255 192 ...

Dear Micca,

Noted & thanks