TechKnowSurge
TechKnowSurge Catalog Videos Applying Rules to an Interfaces Direction
VideoSecurityFree

Applying Rules to an Interfaces Direction

Network access control lists (ACLs) filter traffic on Layer 3 devices by applying rules to specific interfaces and directions, making precise placement essential to effective traffic control.

⚑ Complete this video to capture a CTF flag worth 1 point.

About this video

Network access control lists (ACLs) are ordered sets of rules used to permit or deny traffic on Layer 3 devices, including routers, firewalls, and Layer 3 switches. Each rule evaluates packets against criteria such as source and destination IP addresses, and rules are processed sequentially until a match is found. Understanding how ACLs are structured is only part of the picture — where and how they are applied determines whether they actually enforce the intended policy. Every interface on a Layer 3 device carries traffic in two distinct directions: inbound, meaning traffic entering the interface, and outbound, meaning traffic leaving it. An ACL is always applied to a specific direction on a specific interface, and a single interface can have separate ACLs assigned to each direction. Not every interface requires an ACL, but when one is applied, that direction assignment is critical. Placing an ACL on the wrong direction or the wrong interface causes it to never match the target traffic, leaving the rule functionally useless even though it is technically configured. For example, a rule designed to block traffic from a specific source to a specific destination must be positioned where the packet will actually pass through in that direction — either inbound on the source-side interface or outbound on the destination-side interface. Each placement carries its own trade-offs, but stopping traffic as early as possible is generally preferred because it prevents the packet from consuming additional routing resources before being dropped.

What you'll learn

What's covered

Applying Network ACLs

Key terms

Access Control List
ACL
A set of rules that defines which users or systems are granted or denied access to a resource.
Router
A network device that forwards data packets between networks based on IP addresses.
IP Address
A numerical label assigned to each device connected to a network that uses the Internet Protocol.
Packet Filtering
A firewall technique that inspects packets and allows or blocks them based on source, destination, and protocol.
Ingress Filtering
The practice of monitoring and restricting inbound network traffic based on security policies.
Egress Filtering
The practice of monitoring and restricting outbound network traffic based on security policies.
Interface Direction
The orientation of traffic flow on a router interface, either inbound (into the interface) or outbound (out of the interface), which determines where an ACL is applied and evaluated.

Topics

Access Control Lists Network Security Router Configuration Traffic Filtering Networking Packet Filtering

Transcript

What we want to do is take these access control lists, or these rules, and apply them to the interface. There's certain ways that these are constructed and applied, so we need to understand that.

Rules on layer 3 devices

A network access control list allows us to control the traffic going across these layer 3 devices, whether it's a router or firewall or it's some sort of layer 3 switch. Many times we also call these rules. We have a list of rules that apply and they get processed all in order.

But it's really critical where you place these, as to whether they're functional or not, or really cause problems, or they just are not effective. It's really critical how we place them. And part of this criticality is we have a source IP address going to a destination IP address, and that's a critical part about this.

In and out directions

This is a router right here, and a router has interfaces. Let's just say that all of these are Ethernet interfaces. So this is the Ethernet interface for LAN 1, and this is the Ethernet interface for LAN 2, and this is the Ethernet interface for LAN 3. So we've got an Ethernet plugged into each one of these, just one Ethernet plug, so this is just one connection right here. But we have traffic that's going two ways: we've got traffic that's coming into this interface and traffic that's going out of this interface.

How does LAN to LAN traffic work on this? Well, we have a laptop that's communicating to a desktop over here. Let's say this laptop right here is going to send a packet to this desktop. What happens is this packet exits this computer and comes into this interface. The router then routes it and does its thing, and then routes it out to this computer right here. And then this computer sends maybe some sort of response, where it comes into this interface, sends a response over, and comes out to this laptop over here. So that's how it works: we have an in direction and an out direction for each one of these interfaces.

A network access control list gets applied to a direction on an interface. So for instance, let's say we create an access control list number one. What's going to happen is we're going to apply that to the interface of LAN 1 on the in direction, so that's going to be number one. And maybe we apply a second one to the out of that. And then we apply a third one to the in on LAN 2, and apply a fourth one to the out of that, and so on and so forth. So it's going to be applied to a direction on each of these interfaces.

Now, we don't necessarily have to have an access control list. There are some interfaces that don't have any access control list. But if we do apply one, it's going to be applied to a direction on that interface.

Why the direction matters

This is why this is so critically important. Let's say we have a machine on this network which is 192.168.54.16, and we do not want it to communicate to 192.168.64.54. We want to make sure that these two do not communicate with each other. So what we do is we create an access control list that we're going to apply to deny traffic from this source IP address to this destination IP address.

Now what we do is we apply it on the in of this LAN 1. What's going to happen as it comes into here? It's going to match this source and say yes, that matches, and to that destination, yes, that matches, and deny that traffic.

But let's put it on the wrong interface. Now let's plug it in on the out. What's going to happen is that this packet is going to come in here. We don't have an access list that is applied to that one. It's going to come over here and then it's going to come out and go to here. So now what's going to happen is that this entry never gets executed, never gets matched, because it's on the wrong direction here.

We can even put it on the out over here, and that would be fine. So if we put it over here, what would happen is it would come through here and then get matched with this, by saying it's going to hit this and it's going to say, well, is this the source? Well, the packet is coming from that source, yes, so that's correct. And is this the destination? Yes.

So there's actually two spots we could put this. We could put it on the in of this interface or the out of this interface. And there's advantages and disadvantages to all of those. It's kind of nice to stop it right from the beginning and make sure that it doesn't go any further than that. But there is another spot that we could actually put this as well.

So that's all to say that in how we configure these, we need to make sure we get it in the right direction, whether it's going into the interface or coming out of the interface.

About TechKnowSurge

TechKnowSurge builds IT and cybersecurity professionals through hands-on, concept-first training built around real understanding — not memorization. Free interactive tools, structured programs, and 25+ years of real-world experience, all in one place.

Explore free tools and programs →