Skip to content
TEQcloud Knowledge base

Extended ACLs

Extended ACLs filter traffic based on source IP, destination IP, protocol, and port numbers - gives granular control over what traffic is allowed.

Why Use Extended ACLs?

Section titled “Why Use Extended ACLs?”

You need extended ACLs when:

  • You want to allow/block specific services (HTTP, SSH, FTP, etc.)
  • You need to filter based on source AND destination
  • You want to allow outbound traffic but block inbound connections (established keyword)
  • Standard ACLs are too broad for your needs

ACL Numbers: 100-199, 2000-2699

Placement Rule: Apply close to the source (prevents unwanted traffic from traversing the network - saves bandwidth).

Numbered Extended ACL Syntax

Section titled “Numbered Extended ACL Syntax”
Router(config)# access-list 100 permit tcp 192.168.10.0 0.0.0.255 any eq 80
Router(config)# access-list 100 permit tcp 192.168.10.0 0.0.0.255 any eq 443
Router(config)# access-list 100 deny ip any any

Format:

access-list [number] [permit|deny] [protocol] [source] [source-wildcard] [destination] [dest-wildcard] [operator port]

Common protocols:

  • ip = All IP traffic
  • tcp = TCP only
  • udp = UDP only
  • icmp = ICMP (ping, traceroute)

Port operators:

  • eq = Equal to (e.g., eq 80)
  • gt = Greater than
  • lt = Less than
  • neq = Not equal to
  • range = Port range (e.g., range 20 21)

Named Extended ACL

Section titled “Named Extended ACL”
Router(config)# ip access-list extended WEB-TRAFFIC
Router(config-ext-nacl)# permit tcp 192.168.10.0 0.0.0.255 any eq 80
Router(config-ext-nacl)# permit tcp 192.168.10.0 0.0.0.255 any eq 443
Router(config-ext-nacl)# deny ip any any
Router(config-ext-nacl)# exit

Common Port Numbers

Section titled “Common Port Numbers”
ServicePortProtocol
HTTP80TCP
HTTPS443TCP
FTP Data20TCP
FTP Control21TCP
SSH22TCP
Telnet23TCP
SMTP25TCP
DNS53TCP/UDP
DHCP67, 68UDP
TFTP69UDP
POP3110TCP
SNMP161UDP

Using port names:

Router(config)# access-list 100 permit tcp any any eq www
Router(config)# access-list 100 permit tcp any any eq 80

Both commands do the same thing (www = port 80).

Apply ACL to Interface

Section titled “Apply ACL to Interface”
Router(config)# interface GigabitEthernet0/0/0
Router(config-if)# ip access-group 100 in

Example: Allow Web Traffic Only

Section titled “Example: Allow Web Traffic Only”
Router(config)# access-list 110 permit tcp 192.168.10.0 0.0.0.255 any eq 80
Router(config)# access-list 110 permit tcp 192.168.10.0 0.0.0.255 any eq 443


Router(config)# interface GigabitEthernet0/0/0
Router(config-if)# ip access-group 110 in

Now only HTTP (80) and HTTPS (443) traffic from 192.168.10.0/24 is allowed outbound.

Example: Block Specific Host from Internet

Section titled “Example: Block Specific Host from Internet”
Router(config)# access-list 120 deny ip host 192.168.10.50 any
Router(config)# access-list 120 permit ip any any


Router(config)# interface GigabitEthernet0/0/0
Router(config-if)# ip access-group 120 in

TCP Established (Stateful Filtering)

Section titled “TCP Established (Stateful Filtering)”

Allow outbound connections and their return traffic, but block inbound connection attempts.

Router(config)# access-list 130 permit tcp any 192.168.10.0 0.0.0.255 established


Router(config)# interface GigabitEthernet0/0/0
Router(config-if)# ip access-group 130 out

How it works: The established keyword permits TCP packets with ACK or RST flags set (indicating an existing connection). Blocks new inbound connections from the internet.

Common pattern (inbound + outbound ACLs):

! Outbound: Allow inside hosts to access web
Router(config)# access-list 110 permit tcp 192.168.10.0 0.0.0.255 any eq 80
Router(config)# access-list 110 permit tcp 192.168.10.0 0.0.0.255 any eq 443


! Inbound: Only allow return traffic
Router(config)# access-list 120 permit tcp any 192.168.10.0 0.0.0.255 established


Router(config)# interface GigabitEthernet0/0/0
Router(config-if)# ip access-group 110 in
Router(config-if)# ip access-group 120 out

Named Extended ACL Example

Section titled “Named Extended ACL Example”
Router(config)# ip access-list extended ALLOW-WEB
Router(config-ext-nacl)# remark Permit HTTP and HTTPS from internal network
Router(config-ext-nacl)# permit tcp 192.168.10.0 0.0.0.255 any eq 80
Router(config-ext-nacl)# permit tcp 192.168.10.0 0.0.0.255 any eq 443
Router(config-ext-nacl)# exit


Router(config)# ip access-list extended RETURN-TRAFFIC
Router(config-ext-nacl)# remark Only allow returning web traffic
Router(config-ext-nacl)# permit tcp any 192.168.10.0 0.0.0.255 established
Router(config-ext-nacl)# exit


Router(config)# interface GigabitEthernet0/0/0
Router(config-if)# ip access-group ALLOW-WEB in
Router(config-if)# ip access-group RETURN-TRAFFIC out

Allow Specific Host, Block Others

Section titled “Allow Specific Host, Block Others”
Router(config)# ip access-list extended RESTRICT-ACCESS
Router(config-ext-nacl)# remark Allow PC1 full internet access
Router(config-ext-nacl)# permit tcp host 192.168.10.10 any eq 20
Router(config-ext-nacl)# permit tcp host 192.168.10.10 any eq 21
Router(config-ext-nacl)# permit tcp host 192.168.10.10 any eq 22
Router(config-ext-nacl)# permit tcp host 192.168.10.10 any eq 23
Router(config-ext-nacl)# permit tcp host 192.168.10.10 any eq 80
Router(config-ext-nacl)# permit tcp host 192.168.10.10 any eq 443
Router(config-ext-nacl)# permit udp host 192.168.10.10 any eq 53
Router(config-ext-nacl)# permit tcp host 192.168.10.10 any eq 53
Router(config-ext-nacl)# remark Deny all other internal hosts
Router(config-ext-nacl)# deny ip 192.168.10.0 0.0.0.255 any
Router(config-ext-nacl)# exit


Router(config)# interface GigabitEthernet0/0/0
Router(config-if)# ip access-group RESTRICT-ACCESS in

Allow ICMP (Ping)

Section titled “Allow ICMP (Ping)”
Router(config)# access-list 100 permit icmp any any

Allow ping echo-reply only (returning pings):

Router(config)# access-list 100 permit icmp any any echo-reply

Allow DNS

Section titled “Allow DNS”

DNS uses both TCP and UDP on port 53.

Router(config)# access-list 100 permit udp any any eq 53
Router(config)# access-list 100 permit tcp any any eq 53

Block Specific Protocol

Section titled “Block Specific Protocol”
Router(config)# access-list 100 deny tcp any any eq 23
Router(config)# access-list 100 permit ip any any

Blocks Telnet (port 23), allows everything else.

Edit Extended ACL

Section titled “Edit Extended ACL”

View sequence numbers:

Router# show access-lists
Extended IP access list 110
    10 permit tcp 192.168.10.0 0.0.0.255 any eq www
    20 permit tcp 192.168.10.0 0.0.0.255 any eq 443

Remove and replace a line:

Router(config)# ip access-list extended 110
Router(config-ext-nacl)# no 10
Router(config-ext-nacl)# 10 permit tcp 192.168.20.0 0.0.0.255 any eq www
Router(config-ext-nacl)# exit

Insert new line:

Router(config)# ip access-list extended ALLOW-WEB
Router(config-ext-nacl)# 15 permit tcp 192.168.15.0 0.0.0.255 any eq 443
Router(config-ext-nacl)# exit

Remove ACL from Interface

Section titled “Remove ACL from Interface”
Router(config)# interface GigabitEthernet0/0/0
Router(config-if)# no ip access-group 100 in

Delete ACL

Section titled “Delete ACL”
Router(config)# no access-list 100

Or for named ACLs:

Router(config)# no ip access-list extended ALLOW-WEB

Verify Configuration

Section titled “Verify Configuration”
Router# show access-lists
Router# show access-lists 100
Router# show ip access-lists
Router# show ip interface GigabitEthernet0/0/0 | include access list
Router# show running-config | section ip access-list

Check match statistics:

Router# show access-lists
Extended IP access list 110
    10 permit tcp 192.168.10.0 0.0.0.255 any eq www (245 matches)
    20 permit tcp 192.168.10.0 0.0.0.255 any eq 443 (1843 matches)

Example Scenarios

Section titled “Example Scenarios”

Scenario 1: Allow SSH from management subnet only

Router(config)# ip access-list extended SSH-MGMT
Router(config-ext-nacl)# permit tcp 10.100.0.0 0.0.255.255 any eq 22
Router(config-ext-nacl)# deny tcp any any eq 22
Router(config-ext-nacl)# permit ip any any
Router(config-ext-nacl)# exit


Router(config)# interface GigabitEthernet0/0/0
Router(config-if)# ip access-group SSH-MGMT in

Scenario 2: Block social media (example IPs)

Router(config)# ip access-list extended BLOCK-SOCIAL
Router(config-ext-nacl)# remark Block Facebook
Router(config-ext-nacl)# deny ip any 31.13.24.0 0.0.7.255
Router(config-ext-nacl)# remark Block Twitter
Router(config-ext-nacl)# deny ip any 104.244.42.0 0.0.0.255
Router(config-ext-nacl)# permit ip any any
Router(config-ext-nacl)# exit


Router(config)# interface GigabitEthernet0/0/0
Router(config-if)# ip access-group BLOCK-SOCIAL out

Scenario 3: Allow only email and web for guest network

Router(config)# ip access-list extended GUEST-INTERNET
Router(config-ext-nacl)# permit tcp 192.168.99.0 0.0.0.255 any eq 80
Router(config-ext-nacl)# permit tcp 192.168.99.0 0.0.0.255 any eq 443
Router(config-ext-nacl)# permit tcp 192.168.99.0 0.0.0.255 any eq 25
Router(config-ext-nacl)# permit tcp 192.168.99.0 0.0.0.255 any eq 110
Router(config-ext-nacl)# permit tcp 192.168.99.0 0.0.0.255 any eq 587
Router(config-ext-nacl)# permit udp 192.168.99.0 0.0.0.255 any eq 53
Router(config-ext-nacl)# deny ip 192.168.99.0 0.0.0.255 any
Router(config-ext-nacl)# exit


Router(config)# interface GigabitEthernet0/1/0
Router(config-if)# ip access-group GUEST-INTERNET in