TechKnowSurge
TechKnowSurge Catalog Videos Implicit Deny Any Rule
VideoSecurityFree

Implicit Deny Any Rule

Access control lists include a built-in implicit deny rule that automatically blocks any traffic that doesn't match an explicitly defined entry, even though this rule is never manually created.

⚑ Complete this video to capture a CTF flag worth 1 point.

About this video

Access control lists operate on a fundamental distinction between explicit and implicit rules. Explicit rules are deliberately defined — they specify conditions and actions that are clearly stated in the configuration. Implicit rules, by contrast, are never written or created by an administrator; they are built-in behaviors that apply automatically. The most critical implicit rule is the implicit deny, which sits at the end of every access control list and blocks any traffic that does not match a preceding entry. This implicit deny applies universally — any source IP address, any destination IP address, and any port that fails to match an explicit rule will be silently dropped. Because the rule is never visible in the configuration, it is easy to overlook, yet it has significant consequences. Traffic that an administrator assumes will pass through may actually be blocked if a corresponding explicit permit rule is missing. Recognizing that this deny behavior exists by default — not by deliberate configuration — is foundational to building effective and predictable access control policies.

What you'll learn

What's covered

Implicit Deny Any Rule

Key terms

Access Control List
ACL
A set of rules that defines which users or systems are granted or denied access to a resource.
Explicit Rule
An access control rule that is directly stated and deliberately configured by an administrator.
Implicit Rule
An access control rule that is not directly stated but is automatically applied by default, such as a deny at the end of an ACL.
Implicit Deny
A foundational access control principle in which any traffic or request not explicitly permitted by a rule is automatically blocked. It appears as a hidden deny-all rule at the end of every access control list.
Packet Filtering
A firewall technique that inspects packets and allows or blocks them based on source, destination, and protocol.

Topics

Access Control Lists Implicit Deny Network Security Firewall Rules Packet Filtering Networking

Transcript

Explicit and implicit

There is a hidden rule that we need to be familiar with, and believe me, this has caught me before in the past, so it's something that you really need to be familiar with.

There is something called explicit and implicit. Explicit means that you define it, that it's something that's solid, that's something that's stated, versus implicit is just implied. It is not necessarily stated outright, but is just a given.

The implicit deny any rule

The reason why I bring this up is because there is an implicit deny any rule. But what is an implicit deny any rule? If you've noticed, there's this gray box down here, and this is like the end-all be-all: if it doesn't match anything else, what it's going to do is a deny.

We call it implicit because it's not something you actually create. It's just on any access control list that you create. It's like the last implicit rule. It's not stated directly, you've not created it, but it will deny any traffic that doesn't match against anything else. In this case, it could be from any IP address, it could be to any IP address, and it could be any port, and it's just going to deny that traffic.

About TechKnowSurge

TechKnowSurge builds IT and cybersecurity professionals through hands-on, concept-first training built around real understanding — not memorization. Free interactive tools, structured programs, and 25+ years of real-world experience, all in one place.

Explore free tools and programs →