# iptables — Block all inbound, allow established + SSH
iptables -P INPUT DROP
iptables -P FORWARD DROP
iptables -P OUTPUT ACCEPT
iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A INPUT -p tcp --dport 22 -j ACCEPT
iptables -A INPUT -i lo -j ACCEPT

# Cisco ACL — restrict inter-VLAN traffic
access-list 100 permit tcp 10.10.10.0 0.0.0.255 10.20.20.0 0.0.0.255 eq 443
access-list 100 permit tcp 10.10.10.0 0.0.0.255 10.20.20.0 0.0.0.255 eq 22
access-list 100 deny   ip  10.10.10.0 0.0.0.255 10.20.20.0 0.0.0.255
access-list 100 permit ip  any any