ACLs — Access Control Lists

ACL (Access Control List)

An Access Control List is an ordered list of rules that says who or what is allowed or denied access to a resource.
Each rule matches some condition (source IP, destination port, user, file path, etc.) and applies an action (permit / allow or deny / drop).
Think of it as a bouncer with a numbered checklist: the system walks the list from top to bottom and stops at the first rule that matches.

How ACLs work

flowchart TD
  P[Packet arrives] --> R1{Rule 1 match?}
  R1 -->|yes| A1[Apply Rule 1 action]
  R1 -->|no| R2{Rule 2 match?}
  R2 -->|yes| A2[Apply Rule 2 action]
  R2 -->|no| R3{Rule 3 match?}
  R3 -->|yes| A3[Apply Rule 3 action]
  R3 -->|no| D[Implicit deny]

Simple network ACL example

A small office router protects a web server at 10.0.1.50. Only HTTPS from the internet should reach it; SSH is allowed only from the admin subnet 10.0.2.0/24.

#	Action	Source	Destination	Port	Meaning
1	PERMIT	10.0.2.0/24	10.0.1.50	22 (SSH)	Admins on office LAN may SSH to the server
2	PERMIT	any	10.0.1.50	443 (HTTPS)	Anyone may reach the public website
3	DENY	any	10.0.1.50	any	Block everything else to that server

Walkthrough

Traffic	First matching rule	Result
Admin `10.0.2.10` → SSH port 22	Rule 1	Allowed
Customer on internet → HTTPS port 443	Rule 2	Allowed
Attacker on internet → SSH port 22	Rule 3 (Rule 1 does not match — wrong source)	Denied
Anyone → port 8080	Rule 3	Denied

Rule order matters. If Rule 2 (permit any → 443) were placed before Rule 1, admins would still reach SSH only when Rule 1 matches — but a careless “permit any any” at the top would bypass all later restrictions. Always put specific rules before broad ones.

Same idea on Linux (iptables)

iptables is one way to implement ACL-style filtering on a Linux host:

# Allow SSH only from admin subnet
iptables -A INPUT -s 10.0.2.0/24 -d 10.0.1.50 -p tcp --dport 22 -j ACCEPT

# Allow HTTPS from anywhere
iptables -A INPUT -d 10.0.1.50 -p tcp --dport 443 -j ACCEPT

# Drop other traffic to the server
iptables -A INPUT -d 10.0.1.50 -j DROP

Types of ACLs (same idea, different layer)

Type	Where	What is controlled
Network / firewall ACL	Router, firewall, cloud security group	IP addresses, ports, protocols
File-system ACL	Windows NTFS, Linux `setfacl`	Which user/group may read, write, or execute a file
Application ACL	Databases, APIs, Kubernetes RBAC	Which role may call which operation on which object