Depending on the implementation, rules may examine source and destination addresses, protocol numbers, transport ports, direction, or other header fields. ACLs can be applied on routers, switches, hosts, virtual networks, and cloud network boundaries.
Rules are commonly evaluated by defined order or priority, with a documented default action when no rule matches. Many network ACLs filter packets without tracking connection state, while some platforms use the same label for stateful controls. Designers must therefore verify actual evaluation, return-traffic, logging, fragmentation, and IPv4/IPv6 behavior.
Key points
Policy basisStart with required flows and express the narrowest source, destination, protocol, port, and direction that supports them.
PlacementApply rules at useful boundaries, account for alternate paths, and keep routing, NAT, and workload-level controls consistent with the intended policy.
OperationsAssign ownership, document purpose and expiry, review hit and deny logs, test rule changes, and remove obsolete or shadowed entries.
Important limitationAn ACL usually sees limited network metadata, not user intent or complete application behavior. Address reuse, spoofing, encrypted payloads, rule-order mistakes, and bypass paths can all weaken the expected result.