ACLs — The Network Bouncer

20 min In Progress

Learning Objectives

  • Tell standard ACLs apart from extended ACLs
  • Remember the implicit deny-all at the end of every ACL
  • Build a simple rule-based packet matcher

Standard vs Extended

Standard ACLs filter on source IP only. Extended ACLs filter on source, destination, protocol, and port -- much more precise. Every ACL has an invisible 'deny any' at the very end, so anything you didn't explicitly permit gets dropped.

Real Cisco IOS syntax -- reference only.
! Extended ACL: only allow 192.168.1.0/24 to reach HTTPS
access-list 110 permit tcp 192.168.1.0 0.0.0.255 any eq 443
access-list 110 deny ip any any

interface GigabitEthernet0/0
 ip access-group 110 in

Practice — Rule Matcher

The same permit/deny logic as an ordered list of rule dicts checked in Python.

rules = [
    {"action": "permit", "src": "192.168.1.0/24", "port": 443},
    {"action": "deny", "src": "any", "port": "any"},
]

def check(src, port):
    for rule in rules:
        if rule["src"] in (src, "any") and rule["port"] in (port, "any"):
            return rule["action"]
    return "deny"  # implicit deny-all

print(check("192.168.1.0/24", 443))
print(check("10.0.0.5", 22))

📝 Exercise: Build an ACL Simulator

Write a function evaluate_acl(rules, packet) where packet is a dict with 'src', 'dst', and 'port'. Walk the rules in order, returning the first matching rule's action ('permit' or 'deny'). A rule field of 'any' matches everything. If no rule matches, return 'deny' (the implicit deny-all). Test against the sample packets.

code.py
Output

            

        

    


    

        ← Back to Chapter