In an open, unfiltered network, routers operate under a friendly principle known as "best-effort delivery." If a packet arrives with a valid destination IP address, the router forwards it toward the target without questioning who sent it, what application protocol it contains, or whether the sender should be communicating with that server at all. While this open trust model allowed the early internet to grow rapidly, it is completely unacceptable in modern corporate networks.
To defend critical assets against unauthorized access, malicious probes, and data breaches, network engineers deploy Access Control Lists (ACLs). An access control list is essentially an ordered checklist of permit or deny statements applied to a router interface. In this chapter, you will learn the core architecture of packet filtering, master the sequential evaluation algorithm, and examine the critical behavior of the implicit deny rule.
How Routers Inspect Packet Headers
Packet filtering functions primarily at Layer 3 (Network) and Layer 4 (Transport) of the OSI model. When an Ethernet frame arrives on a router interface, the router decapsulates the Layer 2 header and inspects the Layer 3 IPv4 header. If an inbound access control list is bound to that interface, the router halts forwarding and compares the packet header fields against each rule in the list.
The router examines several specific header attributes:
- Source IP Address: Where did the packet originate? Is this host on an approved internal subnet, or does it claim to come from an unauthorized external segment?
- Destination IP Address: Where is the packet trying to go? Is it targeting a public web server in the DMZ, or a sensitive human resources database?
- Protocol Identifier: What transport protocol is encapsulated inside the IP payload (TCP protocol number 6, UDP protocol number 17, or ICMP protocol number 1)?
- Layer 4 Port Numbers: What application service is requested? Is the client connecting to standard web ports (TCP 80 or 443), or attempting an unauthorized administrative connection (Telnet port 23 or SSH port 22)?
| Filtering Attribute | OSI Layer | Inspected Header Fields | Standard ACL Support | Extended ACL Support |
|---|---|---|---|---|
| Source IP Address | Layer 3 | 32-bit IPv4 Origin Address | Yes (Primary Filter) | Yes |
| Destination IP Address | Layer 3 | 32-bit IPv4 Target Address | No (Ignored) | Yes |
| Protocol Type | Layer 3/4 | IP Protocol Byte (TCP, UDP, ICMP) | No | Yes |
| Transport Port Numbers | Layer 4 | 16-bit Source and Destination Ports | No | Yes |
The Top-Down Sequential Evaluation Algorithm
The most important concept to master when working with access lists is that rules are evaluated sequentially from top to bottom. When a packet arrives, the router tests it against line 10. If the packet matches line 10, the router takes the specified action (permit or deny) immediately and halts all further inspection. The router never checks line 20, line 30, or line 40 once a match is found!
This "first-match-wins" design means that the order of your statements is critical. If you accidentally write a broad permit statement at line 10, such as permit any, that rule matches 100% of incoming traffic. Any specific deny statements placed further down in the list will never be executed, leaving your network vulnerable to attack.
As a golden engineering rule, always place your most specific rules at the top of the list, followed by more general category rules, and conclude with default boundary behavior.
The Invisible Law: Implicit Deny All
Every access control list contains an invisible rule automatically placed at the very end of the list: Implicit Deny Any. You will not see this rule listed in configuration commands, but the router operating system enforces it without exception.
The implicit deny rule states: If a packet reaches the end of the access control list without matching any explicit permit statement, drop it immediately and silently. This "default deny" security posture is an international security standard. It guarantees that an administrator must explicitly grant permission for traffic to enter or exit.
Because of implicit deny, an access control list containing only deny statements is virtually useless. It would deny the specified bad traffic on lines 10 and 20, and then the implicit deny rule at the end would drop all the legitimate good traffic too! To allow normal business traffic to pass, every functional ACL must include at least one permit statement.
Inbound versus Outbound Interface Direction
Access control lists do not filter traffic until they are bound to a router interface using an interface configuration command. When applying an ACL, you must declare whether it inspects traffic in the inbound direction or the outbound direction.
An inbound ACL inspects packets as they arrive through the physical cable, before the router performs its routing table lookup. If the packet is denied, it is dropped immediately, saving the router CPU from wasting time calculating a route for unauthorized traffic.
An outbound ACL inspects packets after the router has chosen the exit interface, right before the packet is placed onto the physical cable. If you need to filter traffic arriving from multiple internal interfaces headed out toward one common internet gateway, applying an outbound ACL on that gateway interface is the most efficient design.
Hands-On Lab Practice
In this introductory security lab, you will explore a router protecting an internal file server from an unauthorized guest laptop while allowing employee workstations to communicate freely. You will inspect the active access control list, observe how the router evaluates incoming packets sequentially, and verify that the implicit deny rule drops unmatched traffic.
Take time to review the simulation logs. When a packet is denied by an access list, the simulator records the exact rule number and the interface direction, giving you clear insight into router security logic.