Access Control Lists (ACLs): The Gatekeepers of Network Traffic

Every packet that enters or leaves a network passes through decision points. At these decision points, something has to decide: does this traffic belong here, or does it get dropped? That something is an Access Control List.

What Are ACLs and Why Do They Matter?#

An Access Control List is a sequential list of permit or deny statements (called Access Control Entries, or ACEs) that a router evaluates against every packet header. Think of it as a bouncer at a club with a very specific guest list, checking people one by one from the top of the list down.

Packet filtering, sometimes called static packet filtering, examines incoming and outgoing packets against criteria like:

• Source IP address
• Destination IP address
• Protocol type (TCP, UDP, ICMP)
• Source and destination port numbers

But ACLs are not just security tools. They serve multiple roles across a network:

• Traffic filtering: Block specific traffic types like Telnet while allowing SSH
• VTY line protection: Control who can remotely access the router itself
• NAT: Identify which traffic gets translated
• QoS: Classify traffic for quality of service treatment
• Route filtering: Control which routes are advertised or received in routing protocols

The key insight: ACLs are processed sequentially, top to bottom, first match wins. Once a packet matches an ACE, the decision is made immediately and no further entries are checked.

Standard vs Extended ACLs#

Standard ACLs#

Standard ACLs are the simpler of the two. They only examine the source IP address. That is all they can see.

• Numbered range: 1-99 and 1300-1999
• Placement: as close to the destination as possible

Why near the destination? Because standard ACLs cannot distinguish where traffic is going. If you put a standard ACL near the source blocking traffic from 10.0.0.5, you block that host from reaching everything, not just the one server you intended to protect.

Extended ACLs#

Extended ACLs are the precision instruments. They can filter on source IP, destination IP, protocol, source port, and destination port.

• Numbered range: 100-199 and 2000-2699
• Placement: as close to the source as possible

Why near the source? Because extended ACLs are precise enough to block only the exact traffic you want. Placing them at the source prevents unwanted packets from consuming bandwidth across intermediate links.

Named ACLs: The Modern Approach#

Instead of remembering what access-list 47 does, named ACLs use descriptive identifiers:

ip access-list standard BLOCK-HOST
  deny host 192.168.10.10
  permit any

ip access-list extended WEB-ONLY
  permit tcp any any eq 80
  permit tcp any any eq 443
  deny ip any any

Named ACLs have practical advantages over numbered ones: you can add or remove individual lines without destroying and recreating the entire list, they are self-documenting, and they are the recommended approach in production environments.

Wildcard Masks: The Inverse Logic#

Wildcard masks tell the router which bits to match and which to ignore. A 0 bit means "this must match exactly." A 1 bit means "I don't care what this is."

The calculation is straightforward: subtract the subnet mask from 255.255.255.255.

Subnet mask:   255.255.255.0
Wildcard mask: 255.255.255.255 - 255.255.255.0 = 0.0.0.255

Common examples:

Two keywords simplify common cases: host equals wildcard 0.0.0.0 (one specific address), and any equals wildcard 255.255.255.255 (all addresses).

Processing Order: The First-Match Rule#

ACLs follow strict top-down, first-match processing:

1. Router compares the packet against the first ACE
2. If it matches, the action (permit/deny) is taken immediately
3. If no match, move to the next ACE
4. If nothing matches, the implicit deny drops the packet

This means order is everything:

! WRONG: the deny never fires because permit any matches first
access-list 1 permit any
access-list 1 deny host 192.168.10.10

! CORRECT: specific deny first, then general permit
access-list 1 deny host 192.168.10.10
access-list 1 permit any

The implicit deny at the end of every ACL is invisible in the configuration but always active. An ACL with no permit statements blocks all traffic.

The Three Ps Rule#

Every interface has strict limits on ACL application:

• One ACL per Protocol (one for IPv4, one for IPv6)
• One ACL per Direction (separate for inbound and outbound)
• One ACL per Interface

Maximum: one ACL per interface, per direction, per protocol.

Inbound vs Outbound: When the Check Happens#

Inbound ACL: checked before the routing decision. If denied, the packet never reaches the routing table.

Outbound ACL: checked after the routing decision. The router first determines the exit interface, then checks if an outbound ACL exists on that interface.

This distinction matters for performance. Inbound ACLs save routing resources by dropping bad traffic early. Outbound ACLs let the routing process complete before filtering.

Real Configuration: Standard ACLs#

Numbered standard ACL protecting a server network:#

access-list 1 deny host 192.168.10.10
access-list 1 permit 192.168.10.0 0.0.0.255
access-list 1 deny 192.168.0.0 0.0.255.255
access-list 1 permit 192.0.0.0 0.255.255.255

interface GigabitEthernet0/1
  ip access-group 1 out

Securing VTY lines (remote access):#

access-list 5 permit host 192.168.1.3

line vty 0 4
  access-class 5 in
  transport input ssh

Note: VTY lines use access-class, not access-group. This is a critical distinction.

Real Configuration: Extended ACLs#

Web server protection:#

access-list 101 permit tcp any host 192.168.4.1 eq 80
access-list 101 permit tcp any host 192.168.4.1 eq 443
access-list 101 deny ip 192.168.1.0 0.0.0.255 any
access-list 101 deny ip 127.0.0.0 0.255.255.255 any
access-list 101 deny ip 224.0.0.0 31.255.255.255 any
access-list 101 permit ip any any

Handling return traffic with established:#

access-list 102 permit tcp any any established
access-list 102 permit icmp any any echo-reply
access-list 102 permit icmp any any unreachable

The established keyword permits TCP segments that are part of an existing connection (ACK or RST flag set), allowing return traffic without opening inbound access.

Named extended ACL for department restrictions:#

ip access-list extended SALES-RESTRICTIONS
  deny tcp 10.40.0.0 0.0.0.255 10.20.0.0 0.0.0.255 eq 22
  deny tcp 10.40.0.0 0.0.0.255 10.20.0.0 0.0.0.255 eq 80
  deny tcp 10.40.0.0 0.0.0.255 10.20.0.0 0.0.0.255 eq 443
  deny icmp 10.40.0.0 0.0.0.255 10.30.0.0 0.0.0.255 echo
  permit ip any any

interface GigabitEthernet0/0/1.40
  ip access-group SALES-RESTRICTIONS in

IPv6 ACLs: Different Rules#

IPv6 ACLs work differently from IPv4:

The additional default statements for IPv6 allow Neighbor Discovery to function. Without them, IPv6 addressing would break completely since ND is how IPv6 resolves addresses (the equivalent of ARP in IPv4).

ipv6 access-list RESTRICT-VTY
  permit tcp 2001:DB8:ACAD:A::/64 any eq telnet
  permit tcp any any eq 22
  deny ipv6 any any

line vty 0 4
  ipv6 access-class RESTRICT-VTY in

Editing ACLs with Sequence Numbers#

Every ACL entry gets a sequence number (10, 20, 30 by default). This enables surgical edits:

! View current state
show access-lists
  Standard IP access list BRANCH-OFFICE-POLICY
    10 permit 192.168.30.3 (8 matches)
    20 permit 192.168.40.0, wildcard bits 0.0.0.255

! Insert at position 25
ip access-list standard BRANCH-OFFICE-POLICY
  25 permit 209.165.200.224 0.0.0.31

! Remove a specific entry
ip access-list standard BRANCH-OFFICE-POLICY
  no 25

! Resequence the entire ACL
ip access-list resequence BRANCH-OFFICE-POLICY 10 10

No need to destroy and recreate the entire ACL for a single change.

Troubleshooting: The Systematic Approach#

When an ACL is not behaving as expected, walk through this checklist:

1. Is it applied to the correct interface?
2. Is it applied in the correct direction (in/out)?
3. Are the ACEs in the correct order (specific before general)?
4. Are the source and destination addresses correct?
5. Are the wildcard masks correct?
6. Is the port number correct?
7. Does at least one permit statement exist?
8. Is established used where needed for return traffic?

The most common mistakes: wrong ACE order (general permit before specific deny), ACL applied in the wrong direction, and incorrect wildcard masks.

Key Takeaways#

ACLs remain fundamental to network security despite being one of the oldest filtering mechanisms. They are simple in concept but precise in application. The rules are clear: top-down processing, first match wins, implicit deny at the end. Standard ACLs go near the destination because they lack precision. Extended ACLs go near the source because they have it.

Understanding ACLs is not optional if you work with network infrastructure. They are the first line of defense at the router level, and every firewall technology builds on the same foundational logic of sequential rule matching that ACLs established.