So I've done this a ton of times, but I seem to have stumped myself.
I have an ACL that is for my remote Camera system. I want to allow communication within the internal network over port TCP 4100
There are some other things in the ACL but this mainly for networking/switch management. All of that is working fine, it's just the TCP line #9 that doesn't seem to work. To clarify the VLAN's i'm trying to connect from have no ACL's applied to them so the issue isn't in the inbound traffic. If I apply an implicit permit any any rule to the start of this ACL the traffic works, so I know it's isolated to this rule.
ip access-list extended "DVR-VLAN30"
2 permit ip 192.168.30.0 0.0.0.15 192.168.0.0 0.0.255.255
3 permit ip 192.168.30.0 0.0.0.15 10.1.0.0 0.0.255.255
8 permit ip 192.168.30.0 0.0.0.255 192.168.30.0 0.0.0.255
9 permit tcp 192.168.30.0 0.0.0.255 192.168.0.0 0.0.255.255 eq 4100
10 permit ip 192.168.30.0 0.0.0.255 192.168.30.254 0.0.0.0
20 permit ip 192.168.30.0 0.0.0.255 192.168.4.254 0.0.0.0
30 permit ip 192.168.30.0 0.0.0.255 192.168.4.204 0.0.0.0
50 deny ip 192.168.30.0 0.0.0.255 192.168.0.0 0.0.255.255
55 deny tcp 192.168.30.0 0.0.0.255 192.168.0.0 0.0.255.255
60 deny ip 192.168.30.0 0.0.0.255 10.1.0.0 0.0.255.255
65 deny udp 192.168.30.0 0.0.0.255 192.168.0.0 0.0.255.255
90 permit ip 192.168.30.0 0.0.0.255 0.0.0.0 255.255.255.255
at first I had this rule applied to the vlan as "ip access-group "DVR-VLAN30" in
However I read somewhere that I should try to apply it using "vlan" instead of in. From my understanding it's interchangeable and It seems to work identically to the "in"
vlan 30
name "DVR"
untagged A3-A4,B10,J24
ip helper-address 192.168.4.11
ip helper-address 192.168.4.37
ip address 192.168.30.254 255.255.255.0
ip access-group "DVR-VLAN30" vlan