What an ACL does

A list of rules

An access control list (ACL) is a numbered list of permit and deny lines. Apply it to a router interface, in (packets arriving) or out (packets leaving), and the router checks every packet against it:

1. Start at the top line.
2. Does the packet match this line? If yes, do what it says (permit or deny) and stop. Later lines are never looked at.
3. If no line matches, the packet is denied: every ACL ends with an invisible deny any, the implicit deny.

Remember: Top to bottom, first match wins, and anything not permitted is denied. So an ACL with only deny lines blocks everything.

Four kinds

Below, R1 lets guests reach only the web server's web ports. A guest can browse the site, but its ping and its SSH to the server are blocked, and the router answers "packet filtered":

In NetLab

▶ GUEST
student@GUEST:~$ curl http://10.1.1.10
<html><body><h1>Welcome to WEB</h1></body></html>
student@GUEST:~$ nc -zv 10.1.1.10 22
nc: connect to 10.1.1.10 port 22 (tcp) failed: No route to host
student@GUEST:~$ ping -c 2 10.1.1.10
PING 10.1.1.10 (10.1.1.10) 56(84) bytes of data.
From 192.168.20.1 icmp_seq=1 Packet filtered

--- 10.1.1.10 ping statistics ---
2 packets transmitted, 0 received, 100% packet loss, time 1001ms
▶ R1
R1>enable
R1#show access-lists
Extended IP access list GUEST_IN
    10 permit tcp 192.168.20.0 0.0.0.255 host 10.1.1.10 eq www (2 matches)
    20 permit tcp 192.168.20.0 0.0.0.255 host 10.1.1.10 eq 443
    30 deny ip any any (3 matches)

Tip: The numbers in brackets are matches: how many packets each line caught. They're the fastest way to see what an ACL is doing. clear access-list counters sets them back to 0.