An ACL is a list of rules applied to an interface to control traffic policy.<\/p>\n
There are two main types of ACL:<\/p>\n
Standard<\/strong>: Usually applied to the outbound interface because it only inspects the source address of the packet. Identified by numbers between 1 and 99. Named ACLs are also supported but use a different syntax.<\/p>\n Extended<\/strong>: Usually applied to the inbound interface because it inspects both source and destination IPs, preventing unnecessary traffic from traversing the network. It also filters by port to restrict or allow specific services. Can be identified by numbers (100\u2013199) or names, making them easier to manage.<\/p>\n Standard<\/strong> ACL syntax:<\/p>\n Note: 10<\/strong> is the ACL identifier, 0.0.0.255<\/strong> is the wildcard mask for network 10.0.0.0<\/strong>. For a single host, no wildcard is needed.<\/p>\n Applying to an interface:<\/p>\n Extended<\/strong> ACL syntax:<\/p>\n Note: 100<\/strong> and WEB-POLICY<\/strong> are the ACL identifiers. Using the host<\/strong> keyword removes the need for a wildcard mask, and eq<\/strong> stands for “equal to,” followed by the port number the rule applies to.<\/p>\n Applying to an interface:<\/p>\n Editing a rule in an Extended ACL:<\/p>\n Remember: ACLs always have an implicit final rule that denies all traffic from any source to any destination. To permit everything else, add this at the end:<\/p>\n To allow already-established traffic (i.e., responses to outgoing requests<\/strong>), add “established” at the end of the rule:<\/p>\n Note: established<\/strong> can only be used with tcp<\/strong>, not with udp<\/strong> or ip<\/strong>.<\/p>\n Useful commands to view ACLs:<\/p>\n Removing or modifying a rule:<\/p>\n Note: 100<\/strong> is the ACL identifier, and 30<\/strong> and 20<\/strong> are the line numbers shown by the second command.<\/p>\n A common mistake when creating ACL rules is accidentally blocking return traffic. Double-check your rules to avoid this.<\/p>\n The following example shows how to allow traffic for already-established TCP connections:<\/p>\n In the example above, ACL 100 is applied inbound on a WAN interface. It blocks incoming Telnet connections but allows incoming TCP traffic that belongs to an already-established session, which could itself be a Telnet connection initiated from the inside.<\/p>\n","protected":false},"excerpt":{"rendered":" An ACL is a list of rules applied to an interface to control traffic policy. […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[],"class_list":["post-514","post","type-post","status-publish","format-standard","hentry","category-ccna"],"_links":{"self":[{"href":"https:\/\/dft.wiki\/index.php?rest_route=\/wp\/v2\/posts\/514","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/dft.wiki\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/dft.wiki\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/dft.wiki\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/dft.wiki\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=514"}],"version-history":[{"count":15,"href":"https:\/\/dft.wiki\/index.php?rest_route=\/wp\/v2\/posts\/514\/revisions"}],"predecessor-version":[{"id":5817,"href":"https:\/\/dft.wiki\/index.php?rest_route=\/wp\/v2\/posts\/514\/revisions\/5817"}],"wp:attachment":[{"href":"https:\/\/dft.wiki\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=514"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/dft.wiki\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=514"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/dft.wiki\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=514"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}access-list 10\r\n<\/strong>access-list 10<\/strong> allow 192.168.1.9\r\naccess-list 10<\/strong> deny 10.0.0.0 0.0.0.255<\/strong><\/pre>\n
interface g0\/0\r\nip access-group 10<\/strong> out<\/pre>\n
access-list 100<\/strong> remark Allow HTTP+SSH\r\naccess-list 100 permit tcp host 192.168.10.3 host<\/strong> 10.2.2.1 eq<\/strong> 22\r\naccess-list 100 permit tcp any any eq<\/strong> 80\r\n\r\nip access-list extended WEB-POLICY<\/strong>\r\npermit tcp 192.168.30.0 0.0.0.255 host<\/strong> 10.1.1.1 eq<\/strong> 80\r\npermit tcp 192.168.30.0 0.0.0.255 209.165.200.224 0.0.0.31 eq<\/strong> 80<\/pre>\n
interface g0\/0\r\nip access-group 100 out<\/strong>\r\n\r\ninterface g0\/1\r\nip access-group WEB-POLICY in<\/strong><\/pre>\n
ip access-list extended 100\r\n30<\/strong> permit ip 192.168.10.0 0.0.0.255 192.168.30.0 0.0.0.255<\/pre>\n
access-list 100 deny icmp any any echo\r\naccess-list 100 deny icmp any any echo-reply\r\naccess-list 100 permit ip any any<\/pre>\n
access-list 100 permit tcp<\/strong> any any established<\/strong><\/pre>\n
show access-lists\r\nshow access-list 100<\/strong><\/pre>\n
ip access-list extended 100\r\n<\/strong>do show access-list 100\r\n<\/strong>no 30\r\n20<\/strong> xxxxx<\/pre>\n
access-list 100 permit tcp any any established\r\naccess-list 100 deny tcp any any eq telnet<\/pre>\n