Overview
ACLs (Access Control Lists) are ordered lists of permit/deny rules used on routers, switches, and firewalls to filter traffic. They are closely related to firewall rules and are a workhorse of network access control. This lesson explains ACLs and how they are applied.
Learning objectives
- Define an ACL and its structure.
- Explain how ACLs are evaluated and applied to interfaces.
- Distinguish ACLs from stateful firewalls.
Core concept
An ACL is an ordered set of rules (entries) that match traffic — commonly by source/destination IP, port, and protocol — and permit or deny it. ACLs are applied to a device interface in a direction (inbound or outbound). Like firewall rules, they are evaluated top-down, first match wins, and typically end with an implicit deny all for anything unmatched.
ACLs are often stateless (judging packets individually), which distinguishes them from stateful firewalls that track connections.
How it works
You define the ACL entries in order, then attach the ACL to an interface for a direction. As packets enter or leave that interface, they are checked against the entries in sequence; the first matching entry's action applies, and unmatched traffic hits the implicit deny. Because many ACLs are stateless, you may need entries for both directions of a conversation (unlike a stateful firewall, which auto-permits established return traffic). Order and the trailing implicit deny are as important here as in firewall rules.
Practical example
An ACL on a router interface might permit inbound HTTP/HTTPS to a server and deny everything else:
- permit tcp any host <server> eq 443
- permit tcp any host <server> eq 80
- (implicit) deny all
Attached inbound on the internet-facing interface, it lets web traffic reach the server and drops the rest. If the ACL is stateless, a matching outbound permit for the return traffic may also be required.
Cybersecurity relevance
ACLs implement least-privilege access at network chokepoints, enforcing segmentation and limiting reachability. Misconfigured ACLs — wrong order, missing implicit-deny awareness, overly broad permits — are common weaknesses that either block legitimate traffic or, worse, allow unintended access. Analysts review ACLs to find gaps; defenders use them to precisely control which traffic may traverse a device.
Common mistakes
- Ignoring the implicit deny-all, then wondering why unmatched traffic is dropped (or assuming it is allowed).
- Wrong entry order, letting a broad permit override an intended deny.
- Forgetting stateless ACLs may need rules for return traffic in the opposite direction.
Key takeaways
- An ACL is an ordered permit/deny list applied to an interface in a direction, evaluated first-match-wins with an implicit deny-all at the end.
- ACLs are often stateless, so return traffic may need its own entries, unlike stateful firewalls.
- They enforce least privilege and segmentation at chokepoints; order and the implicit deny are critical to correct behavior.
Check your understanding
- How is an ACL evaluated, and what happens to traffic that matches none of its entries?
- Why might a stateless ACL require rules for both directions of a conversation, when a stateful firewall does not?