What is ACL?

ACL (Access Control List) is a list of rules that determines which traffic or which users have access to a resource, and which do not.

In simple terms: ACL is a set of "allow / deny" rules.

---

#Where ACL is used

ACL is widely used in networks and systems:

• on routers;
• on switches;
• on firewalls;
• in operating systems;
• in cloud and corporate networks.

---

#How ACL works

An ACL consists of rules that are checked in order, from top to bottom.

Each rule answers the question of:

• what (IP, network, port, protocol),
• for whom,
• allow or deny.

As soon as a rule matches, the check stops.

At the end there is almost always a rule for:

• implicit deny, which means "deny everything else."

---

#A simple example

ACL is like a guard with a list:

• if you are on the list, you go through;
• if you are not, entry is denied.

---

#An ACL example on a network (logically)

• allow access from the 192.168.1.0/24 network;
• deny access from all other networks.

---

#Main types of ACL

#1. Standard ACL

Filters traffic only by the source IP address.

Simple, but not very flexible.

---

#2. Extended ACL

Filters traffic by:

• the source IP address;
• the destination IP address;
• the protocol (TCP, UDP, ICMP);
• ports.

The most common and flexible option.

---

#What ACL protects

ACL helps to:

• limit access to networks and services;
• segment the network;
• reduce the attack surface.

ACL is a basic but very important security mechanism.

---

#Limitations of ACL

It is important to understand:

• ACL does not encrypt data;
• it does not analyze packet contents;
• it does not protect against complex attacks.

That is why ACL is usually used together with a firewall and other defenses.