Outbound ACL

As I discussed the Access Control List (ACL) in my previous articles that it is a technique used for monitoring outgoing traffic as well as incoming traffic and allowing them to pass or deny based on the source IP address, destination IP addresses, service protocols and ports.

The rules give control to packets that enter the router, packets that relay through the router, and packets that exit from the router interface. Access Control List does not act on the packets originating from the router.  We can configure and apply ACL operation to inbound and or outbound directions:-

Inbound ACL

In this type of Access Control List, analyze incoming packets before routing them to the outbound interface. An inbound Access Control List is efficient because it reduces the load of routing lookups. If packet not matched to the criteria; It is discarded before routing table lookup.

If ACL permits the packet for outbound then router processed it for routing. Inbound Access Control List is especially perfect to filter packets when the only a single inbound interface is the source of the packets.

Outbound ACL

In this type of Access Control List, the router receives incoming packets and routes the packets to an outbound interface. After route lookup, they are processed through the outbound Access Control List to exit the interface. It is best when packets come from multiple inbound interfaces, and the same filter requires all incoming traffic before exiting the same outbound interface.

The end statement for both inbound and outbound Access Control List is always an implicit deny, which is automatically inserted at the end of each ACL. The implicit deny blocks all types of traffic because of implicit deny. The figure below illustrates the inbound and outbound Access Control List.