ACL

networkingsecurity

Access Control List: an ordered set of permit and deny rules evaluated top-down against traffic, with an implicit deny waiting at the end.

First match wins, which is why rule order is the whole game.

An access control list is an ordered set of permit and deny rules evaluated top to bottom, stopping at the first match. That ordering is the whole behaviour, and the most common mistake is a broad rule placed above a narrower one, which makes the narrower rule unreachable and produces a policy that reads correctly and does not do what it says.

Most implementations end with an implicit deny, so anything not permitted is dropped, and forgetting that is the second most common mistake. ACLs are also stateless unless the platform explicitly says otherwise: they evaluate each packet independently, which means return traffic needs its own permission and the rule set has to be reasoned about in both directions.

← All glossary entries