What is ACL?

An ACL (Access Control List) is an ordered list of permit and deny rules that a router, switch or firewall uses to decide which packets it lets through.

Each rule (often called an access control entry) matches on fields in the packet: source and destination address, protocol, and for TCP and UDP the source and destination ports. The device checks the rules from the top down and acts on the first match, ignoring everything below it. If nothing matches, most platforms apply an implicit "deny everything" at the end, so a list that only permits web traffic silently drops all the rest. An ACL is applied to an interface in a direction (inbound or outbound), and the same list can behave very differently depending on which side it sits on. Classic ACLs are stateless: they look at each packet on its own, so you have to permit the return traffic explicitly, unlike a stateful firewall that tracks connections.

In practice, ACLs turn up in two roles. One is filtering traffic, such as blocking management ports from the internet. The other is selecting things for other features: route maps, NAT rules and QoS policies often reference an ACL just to say "these addresses". A classic troubleshooting trap is an ACL that blocks a routing protocol. OSPF uses IP protocol 89 and multicast to 224.0.0.5, and BGP uses TCP port 179, so a list written only with user traffic in mind can stop an OSPF adjacency or a BGP session from ever forming. Rule order matters too: a broad permit placed above a narrow deny makes the deny unreachable. Modern firewalls, including the Zone-based firewall on VyOS, build on the same first-match idea but add connection tracking through conntrack.