Network Security Access Control Lists
An Access Control List (ACL) is an ordered list of rules that a router or switch uses to permit or deny traffic. ACLs operate similarly to firewall rules but live on network devices like routers and are typically evaluated at the network and transport layers. They are one of the oldest and most fundamental network security tools in use today.
ACL as a Bouncer at a Club
Think of an ACL as a club bouncer holding a list of names. The bouncer reads the list top to bottom. The moment a name matches an entry on the list, the bouncer either lets the person in or turns them away — no need to read the rest of the list.
Traffic arrives at router interface: ACL applied to interface Gi0/1: ┌──────┬──────────────────┬───────────────────────┬────────┐ │ Seq │ Source │ Destination / Port │ Action │ ├──────┼──────────────────┼───────────────────────┼────────┤ │ 10 │ 10.1.1.0/24 │ 10.2.2.100 port 443 │ PERMIT │ │ 20 │ 10.1.1.50 │ 10.2.2.100 port 3389 │ PERMIT │ │ 30 │ 192.168.99.0/24 │ ANY │ DENY │ │ 40 │ ANY │ ANY │ DENY │ ← implicit deny └──────┴──────────────────┴───────────────────────┴────────┘
Standard ACL vs Extended ACL
Standard ACL
A standard ACL filters traffic based only on the source IP address. It is simple and fast but offers less granular control. It cannot distinguish between web traffic and database traffic coming from the same source.
Standard ACL Example: PERMIT source 192.168.1.0/24 ← allow this entire subnet DENY source ANY ← block everything else
Extended ACL
An extended ACL filters on source IP, destination IP, protocol, and port. This allows much more precise control — you can allow a specific device to reach a specific server on a specific port without opening broader access.
Extended ACL Example: PERMIT TCP 10.1.1.0/24 → 10.2.0.5 port 443 ← web app access only PERMIT TCP 10.1.1.10 → 10.2.0.5 port 22 ← admin SSH from one host DENY ANY → ANY ← block everything else
Where ACLs Are Applied
An ACL must be applied to a specific interface on a router and in a specific direction. Misapplying an ACL — wrong interface or wrong direction — either breaks legitimate traffic or lets malicious traffic through unchecked.
[ Router ]
/ \
[Gi0/0] [Gi0/1]
(LAN side) (Internet side)
Inbound ACL on Gi0/1: Filters traffic coming FROM the internet
Outbound ACL on Gi0/1: Filters traffic going TO the internet
Inbound ACL on Gi0/0: Filters traffic coming from LAN users
Inbound vs Outbound Application
An inbound ACL checks packets before the router decides where to send them. It is more efficient because denied packets are dropped immediately without consuming routing resources. An outbound ACL checks packets after routing decisions are made, just before the packet leaves the interface.
Wildcard Masks — How ACLs Specify Address Ranges
ACLs use wildcard masks instead of subnet masks. A wildcard mask works in reverse: a 0 bit means "must match," a 1 bit means "can be anything."
Subnet mask: 255.255.255.0 (standard notation) Wildcard mask: 0.0.0.255 (ACL notation — inverse) ACL entry: PERMIT any source in 192.168.1.x: → source 192.168.1.0 wildcard 0.0.0.255 This matches: 192.168.1.0 through 192.168.1.255 (the last octet can be anything)
ACL Best Practices
Practice | Reason --------------------------------------|------------------------------------------- Place extended ACLs near the source | Drops unwanted traffic early, saves bandwidth Place standard ACLs near destination | Only source filtering available, apply close to destination Always end with explicit deny any | Cisco ACLs have implicit deny, make it visible Use remarks/comments in every rule | Future admins understand the purpose Test ACLs in lab before production | Wrong ACL can lock out all traffic Log denied entries | Security team sees attempted violations Audit ACLs regularly | Remove rules no longer needed
ACL vs Firewall — Key Differences
Feature | ACL (Router) | Firewall -----------------------|----------------------|--------------------------- Stateful tracking | No | Yes (stateful FW) Application awareness | No | Yes (NGFW) Speed | Very fast | Slower (deeper inspection) Location | On routers/switches | Dedicated appliance Primary use | Network access control| Perimeter security Logging detail | Basic | Detailed Complexity | Low to medium | Medium to high
ACLs and firewalls serve complementary roles. ACLs on routers provide fast, efficient traffic filtering at network boundaries between internal segments. Firewalls provide deeper inspection at the perimeter. Using both creates overlapping layers — an attacker who somehow slips past the firewall still faces router ACLs before reaching internal systems.
Real-World ACL Use Case
Scenario: Hospital with separate networks for medical devices and admin PCs
Requirement: Medical device network (10.10.0.0/24) must NOT communicate
with admin network (10.20.0.0/24) except for one monitoring
server at 10.20.0.50 on port 8443.
ACL on the router interface between the two segments:
PERMIT TCP 10.10.0.0/24 → 10.20.0.50 port 8443 ← monitoring allowed
DENY ANY → 10.20.0.0/24 ← all other cross-traffic blocked
PERMIT ANY → ANY ← internet access still works
This ACL ensures a compromised medical device cannot probe or attack administrative systems, while still allowing the one legitimate communication path needed for monitoring.