What is ACL (access control list)?

A list of rules stating, for each object, which accesses are permitted and which are denied. On network equipment, it decides whether to pass or drop packets based on conditions such as source and destination addresses, protocol and port numbers, checking the rules from the top and deciding by the first one that matches. Anything that matches no rule is generally denied (the implicit deny). In file systems, a list of permissions per user is also called an ACL.

Read the beginner explainer: What Is a Firewall? How It Allows and Blocks Traffic

Japanese name: ACL(アクセス制御リスト)

ACL (access control list) appears in 1 practice question across 1 topic, including Network Design and Operations.

Field: Network Design and Operations

Checked from the top, decided by the first match

A network ACL compares a packet with its rules from the top, decides by the "permit" or "deny" of the first rule that matches, and ignores all later rules. Rule order therefore matters: narrow exceptions, such as permitting only one particular server, must be written above broader rules. An unwritten "deny all" rule is assumed at the end (the implicit deny), so any traffic that fits no permit rule is discarded.

Where and in which direction to apply

An ACL is configured on a router or switch interface for either incoming or outgoing packets. An ACL that specifies source, destination and port numbers in detail is best placed near the source, so unwanted traffic is dropped early and does not waste links along the way. An ACL that matches only on the source would also block traffic to other destinations if placed near the source, so it is normally placed near the destination. An ACL looks at each packet on its own, so to let through only the return traffic of connections started from inside, the stateful features of a firewall, which remember connection state, are used.

File-system ACLs

The term ACL is also used for access rights on files and folders. Basic Linux permissions can express only three sets of rights, for the owner, the group and everyone else, but ACLs can add read and write rights for particular users or groups. NTFS on Windows also uses per-file ACLs to define detailed rights. The objects differ, but the idea of "a list of what is allowed to whom (or what)" is the same.

Try it: questions about ACL (access control list)

An ACL that checks incoming packets from the top is applied to a router interface. Rule 1 is "permit traffic to TCP port 443 on 10.0.0.10," rule 2 is "deny all traffic from source 192.168.1.0/24," and rule 3 is "permit traffic from source 192.168.0.0/16 to TCP port 80"; there are no other rules. Of the four packets (i) "from 192.168.1.5 to TCP port 443 on 10.0.0.10," (ii) "from 192.168.1.5 to TCP port 80 on 10.0.0.20," (iii) "from 192.168.2.5 to TCP port 80 on 10.0.0.20" and (iv) "from 192.168.2.5 to TCP port 22 on 10.0.0.20," which choice lists all the packets that are let through?

A(i) and (iii)
B(i), (ii) and (iii)
C(i), (iii) and (iv)

Show answer and explanation

Answer: A. (i) and (iii)

An ACL compares a packet with the rules from the top, decides to permit or deny it by the first rule that matches, and does not look at any later rules. A packet that matches no rule is discarded by an invisible "deny all" rule at the end (the implicit deny). Packet (i) matches rule 1 and is permitted. Packet (ii) also fits rule 3, but it matches rule 2 (source 192.168.1.0/24) first and is denied. Packet (iii) matches neither rule 1 nor rule 2 and is permitted by rule 3, and packet (iv) matches no rule and is discarded by the implicit deny.

FAQ

Do I need to write "deny all" at the end of an ACL?

Most equipment has an implicit deny at the end, so traffic that is not permitted is discarded even if you do not write it. However, when you want to record denied traffic, you may write an explicit "deny all" rule with logging enabled. Conversely, applying an ACL that contains only deny rules stops all traffic because of the implicit deny, so care is needed.

What is the difference between an ACL and a firewall?

An ACL permits or denies packets one by one according to rules and is a basic feature of routers and switches. A firewall is dedicated equipment or software that, in addition to ACL-like rules, offers features such as stateful inspection, which remembers connection state and automatically lets return traffic through, and application identification.

ACL (access control list) in the explanations

An ACL compares a packet with the rules from the top, decides to permit or deny it by the first rule that matches, and does not look at any later rules.
An ACL that checks incoming packets from the top is applied…

Questions that mention ACL (access control list) (1)

An ACL that checks incoming packets from the top is applied to a router interface. Rule 1 is "permit traffic to TCP port 443 on 10.0.0.10," rule 2 is "deny all traffic from source 192.168.1.0/24," and rule 3 is "permit traffic from source 192.168.0.0/16 to TCP port 80"; there are no other rules. Of the four packets (i) "from 192.168.1.5 to TCP port 443 on 10.0.0.10," (ii) "from 192.168.1.5 to TCP port 80 on 10.0.0.20," (iii) "from 192.168.2.5 to TCP port 80 on 10.0.0.20" and (iv) "from 192.168.2.5 to TCP port 22 on 10.0.0.20," which choice lists all the packets that are let through?

Books on Network Design and Operations Ad

Search Amazon for semiconductor Network Design and Operations

As an Amazon Associate I earn from qualifying purchases.

Back to the glossary