# What is a Network Access Control List (ACL)?

> A network access control list (ACL) is a set of rules that permits or denies network traffic according to packet and interface attributes.

- Canonical URL: https://yellowcube.eu/glossary/network-access-control-list/
- Publisher: Yellow Cube
- Language: en
- Contact: hello@yellowcube.eu

## Content

Depending on the implementation, rules may examine source and destination addresses, protocol numbers, transport ports, direction, or other header fields. ACLs can be applied on routers, switches, hosts, virtual networks, and cloud network boundaries.

Rules are commonly evaluated by defined order or priority, with a documented default action when no rule matches. Many network ACLs filter packets without tracking connection state, while some platforms use the same label for stateful controls. Designers must therefore verify actual evaluation, return-traffic, logging, fragmentation, and IPv4/IPv6 behavior.

### Key points

- **Policy basis:** Start with required flows and express the narrowest source, destination, protocol, port, and direction that supports them.
- **Placement:** Apply rules at useful boundaries, account for alternate paths, and keep routing, NAT, and workload-level controls consistent with the intended policy.
- **Operations:** Assign ownership, document purpose and expiry, review hit and deny logs, test rule changes, and remove obsolete or shadowed entries.
- **Important limitation:** An ACL usually sees limited network metadata, not user intent or complete application behavior. Address reuse, spoofing, encrypted payloads, rule-order mistakes, and bypass paths can all weaken the expected result.

### Related terms

[Access control](<https://yellowcube.eu/glossary/access-control/>) · [Network access control (NAC)](<https://yellowcube.eu/glossary/network-access-control/>) · [Firewall](<https://yellowcube.eu/glossary/firewall/>) · [Network segmentation](<https://yellowcube.eu/glossary/network-segmentation/>) · [Stateless packet filtering](<https://yellowcube.eu/glossary/stateless-packet-filtering/>)

### Sources

[NIST glossary: Access Control List](https://csrc.nist.gov/glossary/term/access_control_list) · [NIST SP 800-41 Rev. 1: Guidelines on Firewalls and Firewall Policy](https://csrc.nist.gov/pubs/sp/800/41/r1/final)

## Attribution and scope

This Markdown representation is generated from the same approved content records as the canonical HTML page. Cite the canonical URL above when referencing this material. Product and service descriptions are informational; confirm project-specific requirements with Yellow Cube.