Access Control Lists in Action

An ACL (Access Control List) is an ordered set of rules that permits or denies traffic based on its characteristics. Routers, switches, and firewalls use ACLs to decide which packets may pass and which are dropped.

Each rule, or ACE (Access Control Entry), matches traffic by criteria like source address, destination, protocol, or port, and applies an action: permit or deny.

A typical ACL rule examines:

• Source IP address (who is sending)
• Destination IP address (where it is going)
• Protocol (TCP, UDP, ICMP)
• Port number (which service)

By combining these, you can write precise rules like permit web traffic to one server while denying everything else, controlling access at a fine level.

ACLs are evaluated top to bottom, and processing stops at the first matching rule. Order is therefore critical: a broad rule placed early can override more specific rules below it that never get reached.

The general best practice is to put specific rules first and broader rules later, so the precise exceptions are evaluated before the catch-all entries.

Most ACLs end with an invisible implicit deny all: any traffic not explicitly permitted is dropped. This default-deny behavior is a security feature, but it surprises beginners whose allowed traffic still gets blocked because they forgot to permit something.

Always remember that if no rule matches, the traffic is denied by default. You must explicitly permit what you want to allow.

On routers, two classic ACL types exist:

• Standard ACLs filter only by source IP address, blunt but simple.
• Extended ACLs filter by source, destination, protocol, and port, much more precise.

Extended ACLs are far more common because real policies usually need to say which sources may reach which services, not just who is allowed at all.

ACLs are applied to an interface in a direction: inbound (traffic entering the interface) or outbound (traffic leaving it). The same rule produces different effects depending on direction and which interface it is attached to.

Placing the ACL on the right interface and direction is essential. A correct rule on the wrong interface simply will not filter the traffic you intended.

A basic ACL is stateless: it judges each packet alone with no memory of prior traffic. A stateful firewall tracks connections, so if it permits outbound traffic, it automatically allows the matching replies back.

Stateless ACLs need explicit rules in both directions, which is why stateful firewalls are easier and more common for general traffic filtering.

Read this simple router ACL as an example of how rules combine to permit a service while blocking everything else.

ACLs do many security jobs: blocking known-bad IP addresses, restricting which subnets can reach a server, controlling management access to network devices, and filtering between VLANs or zones.

They are a foundational, flexible tool. Combined with segmentation, ACLs turn the boundaries between zones into enforced rules that decide exactly what traffic may cross.

Common mistakes include rule order errors (a broad rule hiding a specific one), forgetting the implicit deny, applying the ACL to the wrong interface or direction, and accidentally locking yourself out of a device by denying your own management traffic.

Plan and document ACLs carefully, test changes, and always make sure remote-management access remains permitted before applying restrictive rules.

An ACL is an ordered list of permit/deny rules processed top-down until the first match, ending in an implicit deny. Extended ACLs filter by source, destination, protocol, and port; you apply them inbound or outbound on an interface. Used well, ACLs enforce segmentation and protect devices, but careful rule order and placement are essential.

Test your ACL knowledge.

An ACL is an ordered list of permit/deny rules matched by source, destination, protocol, and port. Rules process top-down until the first match, and an implicit deny all drops anything not permitted. Extended ACLs are most precise, are applied inbound or outbound on an interface, and demand careful rule order and placement.