Access control list

The first line that matches decides, and a packet no line matches meets the implicit deny at the end. A standard ACL (IOS numbers 1–99) matches only the source address, so it belongs near the destination; an extended one (100–199, or named) also matches destination, protocol and port, so it belongs near the source. A list acts only once applied to a card: in checks packets as they arrive, before routing, out as they leave; one list per card, direction and protocol. A plain ACL is stateless: replies need their own line (established, or a stateful firewall). On Linux an iptables chain plays the list, each rule a line.

How an access control list works, step by step

An ACL is an ordered list of permit and deny lines, applied to a router interface in one direction. For every packet that crosses that interface in that direction, the router does this:

1. Start at the top. Compare the packet with the first line: source address, and for an extended list the destination, the protocol and the ports.
2. First match wins. The first line that matches decides, permit or deny, and the router stops reading. Lines further down never see that packet, even if they would match it better.
3. No match, denied. Every list ends with an invisible implicit deny: a packet that matches no line is dropped. A list with only deny lines blocks everything.
4. Count. Each line counts its matches, which is how you prove what a list did.

Two kinds of list, two places to put them:

Direction matters too. In checks a packet as it arrives on the interface, before the routing decision; out checks it after routing, as it leaves. An interface takes one list per direction per protocol.

IOS writes address ranges with a wildcard mask, the subnet mask inverted: a 0 bit must match, a 1 bit is free. 10.0.1.16 0.0.0.15 matches .16 to .31, the same block as 10.0.1.16/28.

A plain ACL is stateless. It judges each packet on its own, so a list that denies the servers from reaching the office also drops the replies to connections the office opened. Replies need their own line (established matches TCP segments with ACK or RST set) or a stateful firewall.

What it looks like on a Linux machine

Linux has no access-list command, but an iptables chain is the same machine: rules in order, first match wins, ACCEPT for permit and DROP for deny. In the access control lists lab the policy "only the admin may SSH to the server, everyone may use the web" is an extended list, in IOS:

ip access-list extended OFFICE-IN
 permit tcp host 10.0.1.20 host 10.0.2.10 eq 22
 deny   tcp any host 10.0.2.10 eq 22
 permit ip any any
interface GigabitEthernet0/1
 ip access-group OFFICE-IN in

and on the Linux router:

iptables -N OFFICE-IN
iptables -A OFFICE-IN -p tcp -s 10.0.1.20 -d 10.0.2.10 --dport 22 -j ACCEPT
iptables -A OFFICE-IN -p tcp -d 10.0.2.10 --dport 22 -j DROP
iptables -A OFFICE-IN -j ACCEPT
iptables -A FORWARD -s 10.0.1.0/24 -j OFFICE-IN

An iptables chain that runs out of rules returns to its caller, so the implicit deny must be written out when you want one. The counters are IOS's show access-lists. Insert the deny above the admin's permit, and they show the mistake: the deny caught the admin's two SYNs, the permit below never saw a packet.

$ iptables -L OFFICE-IN -v -n --line-numbers
Chain OFFICE-IN (1 references)
num   pkts bytes target     prot opt in     out     source               destination
1        2   120 DROP       6    --  *      *       0.0.0.0/0            10.0.2.10            tcp dpt:22
2        0     0 ACCEPT     6    --  *      *       10.0.1.20            10.0.2.10            tcp dpt:22

What goes wrong, and how you see it

A line in the wrong order. A broad deny above a specific permit wins every time. Read the list top-down and check which line's counter rises.

A standard list near the source. It can only name who sends, so it blocks that host from everything, not just the one network you meant. The lab shows it, then moves the list next to the destination.

The forgotten implicit deny. A new list with one permit line for a single service cuts off everything else on that interface, routing protocol traffic included.

Replies dropped. A stateless deny for traffic from the servers also catches the servers' answers. The client sees timeouts on connections that should work.

Wrong direction or interface. A list applied in where out was meant, or on the wrong interface, matches nothing. Its counters stay at zero.

Questions people ask

What is the difference between an ACL and a firewall? A basic ACL is stateless and checks each packet alone. A stateful firewall tracks connections, so replies pass without rules of their own. Linux iptables does both: plain rules act like an ACL, and -m conntrack --ctstate ESTABLISHED,RELATED adds state.

Where should an extended ACL go? As close to the source as possible, so unwanted traffic is dropped before it crosses the network.

Can I edit a line in the middle of an ACL? In a named IOS list, yes: lines have sequence numbers (10, 20, 30), so 15 deny … goes between two. In iptables, -I CHAIN 2 inserts at a position.

See it on real machines