Does the Rule Ever See It?

About this interactive

A router has an interface in each network it joins, and every interface carries traffic two ways: in, from the network into the router, and out, from the router onto the network. A network ACL is applied to one direction of one interface, and it only judges the packets that pass that way. Follow the packet. A PC on LAN 1 sending to LAN 2 puts the packet onto LAN 1's interface, inbound. The router routes it and sends it out of LAN 2's interface, outbound. Those are the only two places it passes. A rule denying LAN 1 to LAN 2 therefore works on LAN 1 in, which stops it before it is even routed, or on LAN 2 out. On LAN 1 out, on LAN 2 in, or on LAN 3 in either direction, the rule is never matched and the traffic flows as if the rule did not exist. Get the direction wrong and nothing warns you: the rule sits there, unmatched. That is why where you apply a rule matters as much as what it says.

What you'll learn

Predict whether an ACL applied to an interface in a direction will ever see a given flow: traffic enters on its source network's interface (in) and leaves on its destination network's interface (out)
Identify the two placements that work for a rule denying one network's traffic to another, the source interface in and the destination interface out, and explain why any other placement leaves the rule unmatched

Aligned to

CompTIA Security+

4.5 Given a scenario, modify enterprise capabilities to enhance security.

2.5 Explain the purpose of mitigation techniques used to secure the enterprise.

3.2 Given a scenario, apply security principles to secure enterprise infrastructure.

Key terms

Interface Direction: The orientation of traffic flow on a router interface, either inbound (into the interface) or outbound (out of the interface), which determines where an ACL is applied and evaluated.
Access Control List: A set of rules that defines which users or systems are granted or denied access to a resource.
Router: A network device that forwards data packets between networks based on IP addresses.
Network Interface: A hardware or software component that connects a device to a network, identified by a name such as eth0 or wlan0.

Topics

Interface Direction Access Control List Router Interactive Streak Sort

About TechKnowSurge

TechKnowSurge builds IT and cybersecurity professionals through hands-on, concept-first training built around real understanding — not memorization. Free interactive tools, structured programs, and 25+ years of real-world experience, all in one place.

Explore free tools and programs →