TechKnowSurge

VideoSecurityFree

Network Access Control Lists (NACLs)

Network access control lists (ACLs) define what traffic is permitted or denied between network segments, making them a critical component of effective network security. They can be applied at routers, firewalls, and other devices to enforce boundaries between networks such as internal, guest, and server zones.

⚑ Complete this video to capture a CTF flag worth 1 point.

About this video

Network segmentation creates logical boundaries between different parts of an infrastructure, but without traffic controls at those boundaries, the security benefit is minimal. Network access control lists (ACLs) address this gap by specifying which traffic is allowed to pass between network segments and which is blocked. These rules can be enforced at routers, firewalls, and other network devices, giving administrators granular control over how systems communicate across segment boundaries. An ACL is composed of individual rules — referred to as access control entries (ACEs) on Cisco platforms — each of which defines a permit or deny condition based on criteria such as source or destination IP address, port, or protocol. Together, these entries form a complete policy that shapes traffic flows across the network. A common deployment scenario involves a firewall separating an internet-facing WAN connection, a guest network, an internal network, and a server segment hosting services like a public web server. ACL rules can allow inbound internet traffic to reach the web server on ports 80 or 443 while restricting guest network access to only that server, and preventing guest systems from reaching internal resources entirely. This level of control makes ACLs a foundational tool in network security design. Whether the goal is isolating sensitive systems, limiting lateral movement, or enforcing least-privilege access between departments, ACLs provide the mechanism to translate security policy into enforceable network behavior.

What you'll learn

Explain the purpose and function of network access control lists (ACLs) in controlling traffic between network segments
Describe how ACL rules (permit/deny entries) are applied on network devices to regulate access between networks

What's covered

Network Access Control Lists

Where ACLs Are Found
- Servers and Machines
- Databases and Fields
- Files and Folders
- Network Devices
Access Control Criteria
- Location-Based
- IP Address-Based
- User Accounts or Groups
Network ACL Use Cases
- Between Segmented Networks
- Firewall Traffic Control
- Web Server Port Access
- Guest Network Restrictions
ACL Components
- Access Control Entries (ACEs)
- Permit and Deny Rules
- Rules Form Full ACL

Key terms

Access Control List: A set of rules that defines which users or systems are granted or denied access to a resource.
Network Segmentation: The practice of dividing a network into smaller segments to improve performance and limit the spread of security threats.
Packet Filtering: A firewall technique that inspects packets and allows or blocks them based on source, destination, and protocol.
Firewall: A network security device that monitors and controls incoming and outgoing traffic based on predefined security rules.
Router: A network device that forwards data packets between networks based on IP addresses.
Access Control Entry: An individual rule within an access control list that specifies whether to permit or deny access for a particular user, group, or traffic pattern matching defined criteria. A complete ACL is made up of an ordered sequence of ACEs.

Topics

Network Acls Access Control Network Security Traffic Filtering Network Segmentation Firewall Rules Networking

Transcript

If we segment out our network but then don't implement any kind of access control between those networks, then it's not like we're setting up much security. Ideally, we set up some sort of network access control list, or some way to control the traffic.

What an Access Control List Is

Just like the name suggests, an access control list is a list that controls access. So where do we find access control lists? We could find them on servers or machines. We could find them on databases, and even access to fields or tables or whatever within that database. We could find them within files and folders. We can find them within shares that we have on the network, and we can find them on networks.

Access control just means that you are controlling the access to something. It could be based off of location, it could be based off of IPs, it could be based off of the user account or groups that a user is a part of. It could be based off of any number of things.

Network Access Control Lists

Since this is a networking module, let's talk specifically about network access control lists. A network access control list limits how much access there is from a network perspective.

Here's an example of several networks that we have. We have a management network, an operations network, and a sales network. Maybe this machine right here needs access to all three. So this router might have some sort of access list that allows this machine to be able to access resources on other networks, versus the rest of the machines on this network, which maybe don't have access to any of these other networks. So it's a way to control access between these different networks.

Here's an example where we have a firewall right here. We have the outside world that's connected to it — it's the WAN connection going out to the internet. We have a guest network right here, we have an internal network, and then we have some sort of server network where we have a web server that's running. We want access from the internet into this web server, hitting port 80 or 443 depending how we have this set up, and in order to do that we need to create or allow access to it from the outside world. We'd want access to that also from the internal network and the guest network. And then also with this, we want the guest network to probably not have any other access. So to set this all up, we need to set up network access control lists to be able to tell what is acceptable and what is not acceptable.

Entries and Rules

On Cisco routers, these access control lists are made up of access control entries, or ACEs. Everywhere else, I just see them called rules. Rules are going to be set up as what is acceptable, what is going to be permitted, and what is going to be denied. All the entries combined make a full network access control list. It's a list of these rules.

By implementing these lists or rules on a device, we now can start shaping or controlling the traffic that's flowing from one network into another network.

Read the full transcript Show less

About TechKnowSurge

TechKnowSurge builds IT and cybersecurity professionals through hands-on, concept-first training built around real understanding — not memorization. Free interactive tools, structured programs, and 25+ years of real-world experience, all in one place.

Explore free tools and programs →