Extended Access-List example on Cisco Router

Hi Rene,

In your example

access-list 100 permit tcp host eq 80
this will allow only tcp traffic with port no 80 from to
no where you allowed telnet traffic(port 23) then how telnet is successful.

You are right that telnet traffic, by default, is port 23. However, telnet will run on any port you tell it to. In the lesson, Rene told telnet to use port 80 with the following command

telnet 80 /source-interface loopback 0

Using telnet in this way to probe whether a port is open is a very useful trick that network admins use all the time in troubleshooting/verification.

1 Like

19 posts were merged into an existing topic: Extended Access-List example on Cisco Router

Hi Rene,

The lesson is really great. Thank you very much for it.

I configured the network discussed. But changed loopback of R2 with another network behind R2. The access list was configured in the “out” interface of R2 to prevent all traffic except the http traffic from loopback of R1 to reach the network which replaced the loopback of R2. As expected it filters the traffic from R1 and allows http traffic from loopback of R1. To my surprise the traffic generated in R2 irrespective of it being http or ping is not filtered by the access list eventhough it is configured in the “out” interface of R2. Wonder how this can be explained.

Thank you in advance.


Hi @abcjacob,

There is a good answer for this. Traffic generated by the local router is never matched against access-list on one of your interfaces :slight_smile:


Hi Rene,

Thanks for your very nice article …
I want to know what about the command "ip prefix-list " . It is used to classify/select traffic. Want to know more about this . Thx

I didn’t understand the Andrew statement …

ip access-list extended ACL_TELNET-CLIENT-2-SERVER
**permit tcp host <CLIENT> host <SERVER> eq 23** [Can’t understand the syntax ]


Here’s an example for the prefix-list:

In the extended access-list example from Andrew, is replaced with the source IP address and with the destination IP address. The last part, eq 23 is the destination port number.

For example:

SW1(config-ext-nacl)#permit tcp host host eq 23

Hi Rene,

Have you tackled “lock-and-key” or dynamic ACLs anywhere ? I’ve looked around and haven’t found anything but I might have missed something.

If not will you address this at some point ?

Thanks in advance for you reply !

Hi Thery,

I see I don’t have it…I did create an example a few years ago on gns3vault.com:

I’ll add it to my list and add it later.


Here’s a rather confusing one…
I was able to figure this out in the end. However, I just need confirmation that my logic is correct. I have a router with 3 interfaces. One to the default gateway (, another pointing inwards (to-LAN - and another pointing to another LAN (

When applying an extended access list to the interface and I put OUT (ip access-group 110 OUT) as the direction the access list does not apply.

However using IN on the interface (ip access-group 110 IN) this works perfectly.

I think it’s because the default route is pointing to, which is OUT and the others are seen as IN by the router.

I’ve attached the diagram below to suit. I hope this makes sense.


Hi Floyd,

You need to think about how traffic flows through your router. INBOUND and OUTBOUND only applies to the interfaces, it doesn’t have anything to do with routing.

Looking at your topology, traffic from to enters the Gi0/2 interface and exits the Gi0/0 interface. It never crosses the Gi0/0/0 interface.

This is why the access-list works INBOUND on your Gi0/2 interface. You can also apply it OUTBOUND on your Gi0/0 interface and it will work :slight_smile:

Does this make sense?

Hi again,
Im practicing extended access list. I have two doubts

Im blocking access to the network from the network 172.16.104./24

I dont want that the PCs from network reach the network but I want that PCs from network can reach any PC of the network

Can I do that?

Because when I write the following statement

Access-list 100 deny ip ip

I block access from both networks

Hello Helen

When you create an access list, and you do not apply it anywhere, it actually does nothing. In order for it to function, you must apply it to an interface and a direction. The interface you choose and the direction you choose will directly affect the results. Let’s say you have the following topology:

**SW1**--------(Fe0/1) R (Fe0/2)----------SW2

And you have the subnet connected to SW1 and the 172.16.108/24 subnet connected to SW2. Let’s call these Network A and Network B respectively.

Now, the access list you have created is correct. It will not allow access FROM Network A TO Network B. Now you have to be sure on which interface of the Router to apply it to and in which direction.

The rule of thumb for extended access lists is to place them as close as possible to the source of the traffic. In this case, this is the subnet. So, the interface of the router that is closest to the source is Fe0/1.

Now, which direction? Well the flow of data you want to block is FROM Network A TO Network B, or from SW1 to SW2. From the point of view of the Fe0/1 interface, this is INCOMING traffic.

So, you should put the command ip access-group 100 in on the Fe0/1 interface of the Router.

This should allow all traffic to go from to but not the other way around.

Now the problem that you are facing is the fact that you cannot ping from Network A to Network B which is what you want. But when you try to ping from Network B to Network A you also cannot ping. Why? Because the ping reaches its destination, but when it comes back as a reply, it is blocked by the access list. What you need is a reflexive access list so that any session initiated by A to B will be allowed to return.

You can learn more about reflexive access lists at this lesson.

I hope this has been helpful!


Hi Rene,
I have questions regarding ACL. I have VLAN 2 on L3 core switch. I would like to use ACL to block only single IP in the range to access internet. But, I want this IP to be able to access all other VLANs we have on our core (we have more than 10 vlans). Core switch has default route point to the firewall by using VLAN 3

L3 core switch —using VLAN 3-----Firewall----Internet

ip access-list block-internet
10 deny ip host host (Firewall Interface)
20 Permit ip any any
Int vlan 10
ip access-group block-internet in

It did not work. what is the proper way to do it? Any ideas? Thanks in advance.

Hello Bruce,

Think of the destination IP address when that host sends traffic to something on the Internet. It’s not the IP address of the default gateway, but the IP address of whatever device on the Internet tries to reach.

If you want to make sure that can only reach destinations in your VLANs but not go out to the Internet, you first need to permit traffic to those VLANs. For example:

permit ip host
permit ip host
permit ip host

Then deny all other traffic:

deny ip host any

Then permit everything else if this doesn’t apply to other devices in the subnet:

permit ip any any

If you can’t summary the subnet addresses of your VLANs and the number of VLANs might change sometimes then it’s not a bad idea to use an object-group in your ACL:

This example is for the ASA but it’s pretty much the same for Cisco IOS.

Hope this helps!


Hi Rene,

Thank you so much for your reply. That is exactly what I need. But, I am just curious. If I only block the traffic tcp port 80 and 443 , is it gonna work? Thank you.

  deny tcp host any eq www
  deny tcp host any eq 443
    permit ip any any

Hello Bruce

The access list entries that you have provided will block traffic with the following characteristics:

  1. A source IP address of
  2. Any source port
  3. Any destination IP address
  4. Specific destination ports 80 and 443.

So the access list will block any attempts of the host to access an http or https server.

I hope this has been helpful!


Hello Rene/Laz,
I apologize because my question may not be completely relevant to the topic. However, I would really like to get some help if possible.

Would you please provide me a template for Border inbound ACL at the internet WAN router on the WAN interface? So far this is what I have found. Please let me know if I am missing anything.

ip access-list extended INBOUND
permit icmp any any echo
permit icmp any any echo-reply
permit icmp any any unreachable
deny icmp any any
deny ip any
deny ip 172.16..0.0 any
deny ip any
deny ip any
deny ip host any
permit ip any any

Thank you in advance.

Hello AZM

It’s a good start and you cover most of the issues that can affect the edge. You will also need to examine your network and see what additional traffic you can deny, that is, traffic that you know is invalid for your network. For example, if you will never have an FTP session initiated from the Internet to an internal host, you can block that particular port as well.

Take a look at this Cisco documentation that describes best practices for ACLs at the edge, as they are the first line of defense of your network:

I hope this has been helpful!


how would the ACL configuration be if I had three hosts (, .2, .3) on vlan 10 which currently resides on Fa0/1 that need http access to a host ( on vlan 30 on Fa2/1?