ACL Rule Builder and Tester

About this interactive

What you're doing: a branch router with four LANs hanging off it, and two access lists to write. Extended ACL 110 has to let the Sales LAN reach the intranet web server on 192.168.20.10 over HTTPS, close the rest of the Servers LAN to Sales, and leave every other destination alone. Standard ACL 10 has to let only the NetOps 192.168.40.0/28 block open an SSH session to R1 itself. You place the statements and the two application points, then six test packets are traced against what you built. Why it matters: an ACL is a short ordered program governed by two rules — read top down, stop at the first match, and end in a deny that is never typed. Almost every ACL mistake is one of those two rules being forgotten, and the wildcard mask is the arithmetic underneath both: it is the inverse of the subnet mask, so a /24 is 0.0.0.255, a /28 is 0.0.0.15, and a single host is 0.0.0.0. How to use it: work each statement out before you read the cards, then trace the packets one at a time down the list you wrote rather than guessing from the business rule. Two of the six are built to catch you — HTTP to the very server the HTTPS permit named, and an Engineering workstation reaching the finance database that no list ever inspects.

What you'll learn

Write the statements of an extended IPv4 ACL that permits one destination host on one port and denies the rest of that destination network, ordered so the exception is still reachable under first-match evaluation
Convert a subnet mask to the wildcard mask an ACL statement requires — for a /24, for a /28, and for a single host — and confirm each match by comparing the affected octet in binary
Choose where each list is applied, interface and direction for an extended ACL and the VTY lines for a standard ACL guarding remote access, and justify the choice from what each list type is able to match on
Trace a packet top-down through a finished ACL and state its verdict, including a packet that matches no explicit statement and is stopped by the implicit deny, and a packet the list never evaluates at all because of where it is applied

Aligned to

Cisco CCNA

5.6 Configure and verify access control lists

1.6 Configure and verify IPv4 addressing and subnetting

4.8 Configure network devices for remote access using SSH

CompTIA Network+

4.3 Given a scenario, apply network security features, defense techniques, and solutions

Key terms

Access Control List: A set of rules that defines which users or systems are granted or denied access to a resource.
Standard Access Control List: An ACL that permits or denies traffic based solely on the source IP address of a packet.
Extended Access Control List: An ACL that permits or denies traffic based on source and destination IP addresses, protocol, and port, allowing more granular filtering than a standard ACL.
Wildcard Mask: A 32-bit mask used in ACL statements and OSPF network commands where a 0 bit means the corresponding address bit must match and a 1 bit means it can be anything. Wildcard masks are the inverse of subnet masks and allow a single statement to match an entire range of IP addresses.
Implicit Deny: A foundational access control principle in which any traffic or request not explicitly permitted by a rule is automatically blocked. It appears as a hidden deny-all rule at the end of every access control list.
access-class: A Cisco IOS command used to apply an ACL to VTY lines to restrict remote access based on source IP address, used in place of 'ip access-group' which applies ACLs to interfaces.
VTY Lines: Virtual terminal lines on a Cisco device that allow multiple simultaneous remote management sessions over a network connection.
Subnet Mask: A 32-bit number that divides an IP address into network and host portions.
Packet Filtering: A firewall technique that inspects packets and allows or blocks them based on source, destination, and protocol.

Topics

Interactive Build

About TechKnowSurge

TechKnowSurge builds IT and cybersecurity professionals through hands-on, concept-first training built around real understanding — not memorization. Free interactive tools, structured programs, and 25+ years of real-world experience, all in one place.

Explore free tools and programs →