[Figure: FiveStudy logo]
FiveStudy
Cybersecurity · Unit 3 · 3.4.b
AP Cybersecurity · Securing Networks
Firewalls and Access Control Lists
Rules are checked in order and the first match wins — so order is not cosmetic.
key ideaRules are checked in order, and the first match wins. Order is not cosmetic.
The syntax
An access control list is the set of rules a firewall uses to permit or deny traffic. Each rule states three things — a direction, a criterion, and an action — and the list is read top to bottom until something matches.
| Part of a rule | What it says | Examples |
|---|
| direction | which way the traffic is going | inbound or outbound |
| criterion | what to filter by | IP addresses, logical port, service, application |
| action | what to do with a match | permit or deny |
Those three fields are the whole grammar. Everything difficult about ACLs is about the order of the rules, not about the rules themselves.
a working access control listread top to bottom; first match executes
# dir criterion action
1 inbound tcp port 22 from 203.0.113.0/24 permit
2 inbound tcp port 22 from ANY deny
3 inbound tcp port 443 to 10.0.5.20 permit
4 outbound tcp port 25 from ANY deny
5 inbound ANY deny # implicit default
rule 1a specific permit placed before the broad denyrule 2the broad deny — everything else on port 22 is refusedrule 3a second specific permit, to one destinationrule 4an outbound rule — direction is part of the matchrule 5the default deny — anything unmatched is refused
Doing it step by step
1
Write the requirement in words
‘Administrators from the office range may reach SSH; nobody else may.’ An ACL is a translation, and a vague requirement translates badly.
in a policy out a precise statement
2
Turn each clause into direction, criterion, action
One clause per rule. Resist combining two ideas into one line — it makes the ordering impossible to reason about later.
out a set of candidate rules
3
Order specific before general
Because the first match executes, a narrow permit must sit above the broad deny it is an exception to.
out an ordered list
4
End with an explicit default
State the final action rather than relying on the device's implicit behavior. Deny by default is the safe choice.
out a complete list
5
Trace a packet through it
Take one realistic packet and walk it down the rules. If you cannot say which rule decides it, neither can anyone reviewing the change.
out a verified list
Worked analysis
EX 1
Trace a packet
Using the list above, what happens to an inbound SSH packet from 203.0.113.44?
1
Check rule 1
Inbound, port 22, source in 203.0.113.0/24 — match.
3
Stop
The first matching rule executes; rules 2 to 5 are never consulted.
4
Repeat for a different source
An SSH packet from 198.51.100.9 fails rule 1, matches rule 2, and is denied.
5
State the pattern
One narrow permit above one broad deny expresses “only these, nobody else” in two lines.
EX 2
The rule that never runs
An administrator swaps rules 1 and 2. What breaks?
1
Show the new order
The broad deny now sits first.
2
Trace the same packet
The packet from 203.0.113.44 matches the deny and is refused.
3
Note what happened to the permit
It is never reached — every port-22 packet matched the rule above it.
4
Name the symptom
A rule that appears correct in the list and has no effect whatsoever.
5
State the fix
Specific rules above general ones, always.
the same rules, wrong orderrule 2 can never match
# dir criterion action
1 inbound tcp port 22 from ANY deny
2 inbound tcp port 22 from 203.0.113.0/24 permit # never reached
rule 1broad deny first — it swallows everything on this portrule 2unreachable — correct in isolation, useless heresymptomadministrators are locked out while the list looks right
EX 3
Write an ACL from a requirement
“The web server at 10.0.5.20 must be reachable from anywhere on HTTPS. No other inbound traffic is allowed.” Write it.
1
Extract the permit
inbound tcp port 443 to 10.0.5.20 — permit.
2
Extract the deny
inbound ANY — deny.
3
Order them
Permit first, deny second — otherwise the deny swallows the permit.
4
Check the direction field
Both rules are inbound; outbound traffic is unaffected by this list.
5
Trace one packet each way
HTTPS to the server: permitted. SSH to the server: falls through to the deny. ✓
Verify the result
four checks before shipping
- For each rule, ask: which packet does this decide that no earlier rule already decided?
- A rule with no such packet is unreachable and should be moved or removed.
- Confirm the direction field on every rule — an inbound rule does nothing to egress traffic.
- End with an explicit deny so the default is a decision rather than a device behavior.
Check yourself
What is an access control list?
Show answer
A set of rules, created by network administrators, that a firewall uses to permit or deny inbound and outbound network traffic.
In what order are ACL rules evaluated?
Show answer
In order, top to bottom — and the first rule that matches the criteria is the one executed. Nothing after it is consulted.
What three things does a typical ACL rule specify?
Show answer
The direction of traffic (inbound or outbound), the criterion to filter by (IP addresses, logical port, service or application), and the action to take (permit or deny).
Why can a correct-looking rule have no effect?
Show answer
Because an earlier rule already matched that traffic. Specific rules must sit above the general rules they are exceptions to.