Extended ACL Guide: Permit/Deny by Address and Protocol

Last updated: 23 October 2026. Commands use Cisco IOS / IOS XE syntax. Start with standard ACLs if you are new to ACLs and wildcard masks.

An extended ACL filters traffic by source and destination address, protocol (IP, TCP, UDP, ICMP and others) and port. That makes it far more precise than a standard ACL: you can allow web traffic but block Telnet, let one subnet reach a server only over SSH, or stop guests from reaching internal networks. This guide covers the syntax, placement and the most useful real-world patterns.

Extended ACL syntax

access-list <100-199 | 2000-2699> {permit|deny} <protocol>
    <source> <source-wildcard> [eq|neq|lt|gt|range <port>]
    <destination> <destination-wildcard> [eq|neq|lt|gt|range <port>]
    [established] [log]

Protocol: ip (all IP traffic), tcp, udp, icmp and others. Ports are only available for TCP and UDP.
Addresses: network plus wildcard mask, host a.b.c.d, or any.
Ports: a number or keyword, for example www (80), 443, 22, telnet (23), ftp (21), smtp (25), domain (53).
Rules: first match wins, every ACL ends with an implicit deny ip any any, and you get one ACL per interface, per direction, per protocol.
Placement: put extended ACLs as close to the source as possible, so unwanted traffic is dropped before it crosses the network.

Filtering by source and destination

! Permit only traffic from 192.168.10.0/24 (to anywhere)
access-list 101 permit ip 192.168.10.0 0.0.0.255 any

! Deny traffic from 192.168.10.0/24, permit everything else
access-list 102 deny ip 192.168.10.0 0.0.0.255 any
access-list 102 permit ip any any

! Permit only traffic going to 10.0.20.0/24
access-list 103 permit ip any 10.0.20.0 0.0.0.255

! Deny traffic going to 10.0.20.0/24, permit everything else
access-list 104 deny ip any 10.0.20.0 0.0.0.255
access-list 104 permit ip any any

Between two specific networks

! Allow ONLY 192.168.10.0/24 -> 172.16.0.0/16 (everything else is implicitly denied)
access-list 105 permit ip 192.168.10.0 0.0.0.255 172.16.0.0 0.0.255.255

! Block 192.168.10.0/24 -> 172.16.0.0/16 but allow all other traffic
access-list 106 deny ip 192.168.10.0 0.0.0.255 172.16.0.0 0.0.255.255
access-list 106 permit ip any any

An ACL is applied in one direction on one interface. If you filter both directions, remember that return traffic has the source and destination swapped.

Filtering by protocol and port

Block Telnet and FTP, allow everything else

access-list 110 remark Block clear-text Telnet and FTP
access-list 110 deny tcp any any eq telnet
access-list 110 deny tcp any any eq ftp
access-list 110 permit ip any any

Telnet and FTP send passwords in clear text; use SSH (port 22) and SFTP instead.

Allow SSH to a server only from the admin subnet

access-list 120 permit tcp 192.168.1.0 0.0.0.255 host 10.0.20.10 eq 22
access-list 120 deny   tcp any host 10.0.20.10 eq 22 log
access-list 120 permit ip any any

Guest network: internet only (named ACL)

ip access-list extended GUEST-IN
 remark Guests: DNS and web only, no internal networks
 10 deny   ip 192.168.50.0 0.0.0.255 10.0.0.0 0.255.255.255
 20 deny   ip 192.168.50.0 0.0.0.255 172.16.0.0 0.15.255.255
 30 deny   ip 192.168.50.0 0.0.0.255 192.168.0.0 0.0.255.255
 40 permit udp 192.168.50.0 0.0.0.255 any eq domain
 50 permit tcp 192.168.50.0 0.0.0.255 any eq www
 60 permit tcp 192.168.50.0 0.0.0.255 any eq 443
 70 deny   ip any any log
!
interface GigabitEthernet0/2
 description Guest VLAN gateway
 ip access-group GUEST-IN in

Applied inbound on the guest interface, this drops guest traffic to any private (RFC 1918) range before allowing DNS, HTTP and HTTPS to the internet. If guests get their addresses from a DHCP server on the router itself, also permit DHCP (UDP 67) on this interface.

ICMP: allow replies, block pings to a network

access-list 130 permit icmp any 10.0.20.0 0.0.0.255 echo-reply
access-list 130 permit icmp any 10.0.20.0 0.0.0.255 unreachable
access-list 130 deny   icmp any 10.0.20.0 0.0.0.255 echo
access-list 130 permit ip any any

Be careful blocking all ICMP: messages such as “unreachable” and “packet too big” are needed for path MTU discovery and troubleshooting.

Allow only return traffic with “established”

! Inbound on the internet-facing interface: allow replies to connections started inside
access-list 140 permit tcp any 192.168.10.0 0.0.0.255 established
access-list 140 permit udp any eq domain 192.168.10.0 0.0.0.255
access-list 140 deny   ip any any log

established matches TCP packets with the ACK or RST bit set, so outside hosts cannot open new connections. It is a simple, stateless approximation; Cisco’s reflexive ACLs or a zone-based firewall give real stateful filtering.

Can an ACL block a website?

Not by name. ACLs only see IP addresses and ports, so a line such as deny tcp any any eq www.example.com is invalid (the keyword www simply means port 80). Large websites also use many changing IP addresses behind CDNs, so blocking their IPs is unreliable. To block websites, use:

DNS filtering: a filtering DNS resolver or blocklist on your internal DNS server.
A next-generation firewall or secure web gateway with URL and category filtering.
An object-group or IP-based ACL only for services with a small, stable set of addresses.

Verify and troubleshoot

Router# show access-lists 120          ! lines with match counters
Router# show ip interface GigabitEthernet0/2 | include access list
Router# clear access-list counters
Router# show logging | include IPACCESSLOGP   ! hits on lines with the "log" keyword

Order: a broad permit ip any any placed early makes later lines useless.
Direction: “in” filters packets arriving on the interface, “out” filters packets leaving it.
Remote changes: when editing an ACL on an interface you are connected through, schedule a safety reload (reload in 10) and cancel it (reload cancel) once you confirm access.

Frequently asked questions

How many ACLs can I apply to an interface?

One per protocol per direction: for example, one inbound IPv4 ACL, one outbound IPv4 ACL, and the same again for IPv6.

Numbered or named ACLs?

Named ACLs are clearer, support remarks and sequence numbers, and let you edit single lines, so they are the better choice for production networks.

Need help with network security? We review router and firewall configurations, ACLs and segmentation as part of our VAPT services and hardening audits. Contact us for a quote.

Further reading: Cisco: Configure commonly used IP ACLs.