Access Control Lists

1Recap4 min

The last point returns today, in a new and far more unpleasant form: it is not only routing that must be thought about in both directions, but filtering as well. A list that correctly permits the outbound traffic but forgets the return traffic produces exactly the same symptom - "it does not work" - for an entirely different reason.

Learning outcomes

• Explain what an ACL is and what it can identify in a packet
• Walk mentally through a list of rules and say exactly what happens to a given packet
• Calculate a wildcard mask and say what range of addresses it covers
• Choose between a standard and an extended list and know where each is placed
• Write named lists and edit a single line without rewriting everything
• Permit return traffic without opening the network from the outside
• Troubleshoot a list using the match counter

2The definition of an access list8 min

The last sentence deserves emphasis, because it is the source of the first confusion in the laboratory: a list written in the configuration and not applied to any interface filters absolutely nothing. It is merely text. Applying it is done separately, with a second command.

Filtering is not the only use

On Cisco equipment, an ACL is the standard way of answering the question "which traffic are we talking about?". That is why you will meet it in places that have nothing to do with security:

What a list can "see" in a packet

The criteria available cover layers 3 and 4 of the OSI model - exactly the headers the router reads anyway:

What a classic ACL cannot see: the user's name, the content of the page requested, the domain name, the fact that a file contains a virus. All of these are at layers 5–7 and require a different kind of equipment.

3A router with ACLs, or a dedicated firewall?6 min

The question arises the moment somebody realises that a router can filter: if it can, why do we still buy firewalls? The answer is that they do different things, and the difference is not one of quality but of role.

An ACL costs latency and load on the router's processor: every packet must be compared, in the worst case, with every rule in the list. On a small router, a 300-line list applied to the Internet interface is noticeable.

Where publicly exposed services go

The classic architecture places a firewall between the edge router and the internal network and moves the public services - web server, mail server - into a separate zone called the DMZ (Demilitarised Zone).

4How a list of rules is read10 min

This is the section which, if it is properly understood, makes the rest of the lecture almost trivial. There are three sentences.

The order of evaluation, as an exercise

5Where a list is applied10 min

A list that has merely been written does nothing. For it to take effect, it must be tied to a precise place, and that place has three coordinates.

6The wildcard mask12 min

Here you have to unlearn something. In an access list, addresses are not accompanied by a network mask but by a wildcard mask, and its rule is exactly the reverse.

A wildcard can, however, do things a network mask cannot. A mask requires its 1 bits to be contiguous, from the left. A wildcard has no such restriction: we can leave a 0 bit in the last position and thereby select only the even addresses of a network. It is rarely used, but it explains why the two are not the same thing with the signs swapped.

Start from what is already in the box: 172.16.8.0 0.0.7.255 covers eight consecutive class C networks, from 172.16.8.0 to 172.16.15.255. Look at the binary representation: the three free bits in the third byte produce exactly 2³ = 8 combinations.

Then try three things:

• wildcard 0.0.0.0 over 10.1.1.7 - a single address, the equivalent of host;
• wildcard 0.0.0.1 over 11.2.2.90 - exactly two addresses, .90 and .91; this is the trick by which two rules become one;
• wildcard 255.255.255.255 over any address - absolutely everything, the equivalent of any.

The keywords that shorten the writing

Calculator: from prefix to wildcard and back

Choose /22 and read the result: the wildcard is 0.0.3.255, that is, four class C networks. Choose /30 - the case of links between routers - and you get 0.0.0.3: four addresses, of which two are usable.

7Standard lists10 min

A standard list answers one question only: where does the packet come from? It can say nothing about destination, protocol or port. That is little - but it is enough for the frequent case "this host is not allowed into that segment".

R(config)# access-list 50 deny host 172.16.1.1
                       │   │    │
                       │   │    └── the criterion: which source
                       │   └─────── the action: permit or deny
                       └─────────── the list number (1-99 => standard)

R(config)# access-list 50 remark block the problem host
R(config)# access-list 50 deny host 172.16.1.1
R(config)# access-list 50 permit 172.16.0.0 0.0.255.255

R(config)# interface fastEthernet 0/1
R(config-if)# ip access-group 50 in

Why a standard list is placed near the destination

8Extended lists12 min

An extended list answers four questions at once: from where, to where, with which protocol and on which port. The price is a longer syntax and the obligation not to get the order of the arguments wrong.

access-list 101 deny tcp host 172.16.6.1 192.168.1.0 0.0.0.255 eq 23
            │    │    │        │              │                  │
            │    │    │        │              │                  └ destination port
            │    │    │        │              └──── destination + wildcard
            │    │    │        └───────────────── source (here: a single host)
            │    │    └────────────────────────── the protocol: ip, tcp, udp, icmp...
            │    └─────────────────────────────── the action
            └──────────────────────────────────── the number (100-199 => extended)

Common protocols and ports

The operators available for ports: eq (equal), neq (not equal), lt (less than), gt (greater than) and range 20 21 (a closed interval).

! permit all IP traffic from a single host, to any destination
access-list 101 permit ip host 10.0.0.1 any

! stop all traffic originating in the 10.0.0.0/24 network
access-list 101 deny ip 10.0.0.0 0.0.0.255 any

! stop Telnet from one particular host to one particular network
access-list 101 deny tcp host 172.16.6.1 192.168.1.0 0.0.0.255 eq 23

! permit Telnet from every host in a network, to anywhere
access-list 101 permit tcp 172.16.6.0 0.0.0.255 any eq telnet

Interactive evaluator

Edit the list in the box above and watch the verdicts change. Three observations are worth making carefully.

The first. Rule 4, deny ip host 192.168.10.66 any, appears to block the problem host - but the table shows that its packet is permitted, by rule 3. The reason is the order: permit icmp 192.168.10.0 0.0.0.255 any matches first, and the rest of the list is never checked. Move rule 4 above rule 3 and watch the verdict change. This is, in two lines, the entire trap of access lists: a correct rule, placed too low, does not exist.

The second. The last packet, coming from another network, matches no rule and falls onto the implicit deny - although nobody wrote that line anywhere.

The third. Delete the last line, permit ip 192.168.10.0 0.0.0.255 any, and look at how many packets remain permitted. It is the practical demonstration that a list without a final permit line is a wall.

Where an extended list is placed

9Named lists and editing them7 min

Numbered lists have two serious drawbacks, and it is the second that hurts.

R(config)# ip access-list extended LAN_FILTER_IN
R(config-ext-nacl)# 20 permit ip any any

! we realise two rules are missing, and they must come BEFORE
R(config-ext-nacl)# 5 permit icmp host 10.0.0.1 any
R(config-ext-nacl)# 10 deny icmp any any

! the rule on line 5 had the wrong address: we delete just that one
R(config-ext-nacl)# no 5
R(config-ext-nacl)# 5 permit icmp host 10.0.0.2 any

! applying it to the interface - the same as with numbered lists
R(config)# interface fastEthernet 0/1
R(config-if)# ip access-group LAN_FILTER_IN in

10Lists that take context into account9 min

The problem of return traffic

We want our hosts to browse the web, but nobody outside to be able to initiate a connection towards them. It sounds simple. It is not.

The minimal solution: established

The established option matches TCP packets that have the ACK or RST bit set - that is, those belonging to a conversation already under way. The first packet of a new connection, the one with SYN alone, has no ACK, so it does not match and is stopped.

R0(config)# ip access-list extended HTTP_OUT
R0(config-ext-nacl)# 10 permit tcp 192.168.0.0 0.0.0.255 any eq www

R0(config)# ip access-list extended HTTP_IN
R0(config-ext-nacl)# 10 permit tcp any eq www 192.168.0.0 0.0.0.255 established

R0(config)# interface fa1/0
R0(config-if)# ip access-group HTTP_OUT out
R0(config-if)# ip access-group HTTP_IN in

Notice the structure of the second rule: the source is any eq www - any web server - and the destination is our network. It is the mirror of the first rule, with source and destination swapped, plus the magic word at the end.

Reflexive lists

A reflexive ACL builds the return rules dynamically, from the sessions observed on the way out. When an internal host opens a connection, the router automatically creates the inverse rule, temporarily - and deletes it when the session ends or times out.

They are defined only through named extended lists and use two keywords: reflect, which marks the traffic to be tracked, and evaluate, which applies the rules generated from it.

R0(config)# ip access-list extended OUTBOUND
R0(config-ext-nacl)# 10 permit tcp 192.168.0.0 0.0.0.255 any eq www reflect HTTP_TRAFFIC
R0(config-ext-nacl)# 20 permit icmp 192.168.0.0 0.0.0.255 any reflect ICMP_TRAFFIC

R0(config)# ip access-list extended INBOUND
R0(config-ext-nacl)# 10 evaluate HTTP_TRAFFIC
R0(config-ext-nacl)# 20 evaluate ICMP_TRAFFIC

R0(config)# interface fastEthernet 1/0
R0(config-if)# ip access-group OUTBOUND out
R0(config-if)# ip access-group INBOUND in

This is the first real step towards a stateful firewall: the router no longer judges each packet in isolation but remembers which sessions were initiated from inside. Unlike established, it works for UDP and ICMP as well, because it relies on the pair of addresses and ports rather than on TCP bits.

Time-based lists

Sometimes the rule depends not on the traffic but on the clock: access permitted only during working hours, backups permitted only at night.

R(config)# time-range WORKING_HOURS
R(config-time-range)# periodic Monday Tuesday Wednesday Thursday Friday 9:00 to 18:00

R(config)# ip access-list extended ACL_SCHEDULE
R(config-ext-nacl)# 10 permit tcp any 192.168.1.0 0.0.0.255 eq telnet time-range WORKING_HOURS

R# show time-range

11Verification, logging, remarks6 min

Three mechanisms make the difference between an ACL that has been written and an ACL that is understood.

Remarks - remark, up to 100 characters - explain the intention behind each group of rules, not their syntax. In six months, when somebody else reads the configuration, a remark is worth ten minutes of reconstructing the reasoning.

Logging - the keyword log at the end of a rule - generates a message containing the list number, the action, the source address and the packet count. The message appears at the first matching packet and then every 5 minutes, a mechanism designed precisely so as not to flood the logs.

12Protecting access to the device5 min

So far we have filtered traffic that passes through the router. The last application is different: we filter the traffic that stops at the router - the management sessions.

A router reachable by SSH from anywhere on the Internet is one password away from a disaster. The standard solution is not a list on an interface but one applied to the virtual lines (VTY), with a different command: access-class instead of ip access-group.

R(config)# access-list 5 remark administrator hosts only
R(config)# access-list 5 permit 192.168.99.0 0.0.0.255

R(config)# line vty 0 15
R(config-line)# access-class 5 in
R(config-line)# transport input ssh
R(config-line)# exec-timeout 5 0

The advantage of this approach: the list is applied once and covers every interface, whatever door the connection attempt arrives through. An ACL on an interface would have to be replicated on each one.

13Common mistakes4 min

• "I wrote the list, but it filters nothing" The list exists in the configuration but has not been applied to any interface. It is merely text. Check with show ip interface which list is applied and in which direction.
• "I added the rule, but it has no effect" A rule above it is already catching the traffic. Your rule is never read. show access-lists → 0 matches. Move the rule higher. The specific above the general.
• "I blocked everything, although I meant to block one host" The list has only deny rules. After them comes the implicit deny any. Add a final permit line for the rest of the traffic.
• "The ping goes one way but does not come back" You permitted the outbound traffic and forgot the reply. As with routing, filtering must be thought about in both directions. Either a rule for echo-reply, or established, or a reflexive list.
• "I mixed up in and out" The direction is judged from the router's point of view, not the network's. Ask yourself: does the packet enter the router on this interface, or leave it?
• "I used a network mask instead of a wildcard" permit 10.0.0.0 255.255.255.0 is accepted without error and selects something entirely different. Wildcard = 255.255.255.255 minus the mask. Check with show access-lists, where IOS displays wildcard bits explicitly.
• "I applied the list to the interface I was connected through" The session closes instantly and cannot be reopened. On remote equipment: reload in 5 beforehand, reload cancel once you have confirmed it works.

14Summary and glossary4 min

15Self-check questions6 min

16Further reading2 min

We have learnt to describe traffic and stop it on a Cisco router, with no notion of state and no cryptography whatever. The next lecture looks at the same problem from the point of view of a stateful firewall and a Linux machine, and adds exactly the dimension that is entirely missing here: how we protect the content, not merely the path.

Laboratory 6 configures standard and extended lists on the company topology, together with NAT - and there you will see, in practice, what "the same list, a different meaning of the word permit" amounts to.

• Cisco - Security Configuration Guide: Access Control Lists
• RFC 3871 - operational security requirements for IP infrastructure
• RFC 2827 (BCP 38) - ingress filtering against spoofed source addresses
• The iptables(8) manual, for comparison with the Linux approach