How Rules are Processed

These Rules Apply to Network ACLs

Another thing we should understand is how rules get processed.

One thing that I do want to mention is that these rules are really applied to network access control lists. There are other types of access control lists: ones for servers, one for databases, one for files and folders. There are ones if you are working with Linux systems, ones if you're working with Windows systems, there are share permissions. There are different types of access control lists. The ones that we're talking about here, and the rules that we're going to go over here, apply for network access control lists, and it's not universal to some of those other types of access control lists.

Conflicting Matches

Network access control lists, also known as rules on many devices, get processed in a certain way. There could be some conflicting information. For instance, what we see right here is a specific computer. So this is a host 101010.10, that's an IP address assigned to some host on that network. It is part of this network right here, 1010.0, and also it's part of this network right here, 10, which is actually the same network but it's just a different port.

So we actually have many different matches that a packet could match against. How does this get processed? How do we determine, when there's a conflict here between deny and permit, which rule it's actually going to follow?

How Processing Works

Here's how things get processed on a network access control list.

• First of all, each rule either is a permit or a deny. Those are the two things that it could be. We also have logging, but it still has to either permit the traffic or deny the traffic.
• The rules are in an ordered list, so the order in which the list happens is critically important. Rules get processed in that order. We start at the top of the list, the first entry, and go all the way down — second entry, third entry, fourth entry, fifth entry, and so on and so forth.
• It takes the first match. Whatever the first match is, that is the action it's going to take. It's either going to take the permit or the deny. It's going to take that action and then it's done. Once it's matched, no other rules get processed. It will not continue to process any more rules after that.
• Access lists are applied to an interface and are either inbound or outbound, and we'll talk more about that later on.
• And then there's this implicit deny any rule at the end.

Walking Through an Example

Here's an example of this. Let's go through this process. Let's say a router that has this network access control list on it gets a packet that's coming from the source IP address 1010.131 and going to 10.152.164.15, and it's going to port 53.

So what it's going to do is try to match it against this access control list. It takes the first entry and says, does it match against this? In which case it says, is it coming from this source IP address? And this is specifying it's got to match exactly, so it's got to be 101010. Is that what this is? No, it isn't. This is not a match, so it crosses that off the list — it is not matching up with that.

So it goes to the next one. In this next one, is it part of this network, 1010.0? And it's the whole network range there, a /24. It says yes, that is a match. So now it goes to the destination IP address. Is it going to 10.52.164.15? And we match against this. What this is saying is "any", so it can be really any IP address and it'll be matched, so we've got a match there as well. And then it says port 53 — that is a match as well. So we've got a complete match. Now it will permit that traffic and will not go any further. That's where it stops at that point in time.

If it were to be a different port, for instance 443, it would say, well, it doesn't match that. Now, it doesn't match this line either. So then it goes on to this next one and it matches this one and says, okay, it's permitted, because it's going to 443 here.