The scenario
Client (10.0.1.10) reaches Server (10.0.2.20) through Router. Server runs SSH (22), HTTP (80), HTTPS (443) and MySQL (3306). Router has an access control list (ACL) attached to ge1, the interface facing Server, in the outbound direction: it checks packets as they leave ge1. The list allows TCP port 80 (priority 10) and TCP port 443 (priority 11), denies ICMP (priority 20), and allows everything else (priority 100). Packets from Client to Router's own addresses, and packets leaving through ge0 towards Client, are not checked by this list at all.
What you will work out
Understand how an ACL attached to one router interface and direction filters traffic, and what it means that ACLs are stateless.
Why this matters
ACLs are the standard way to filter on routers: Cisco IOS, Juniper Junos (as firewall filters) and most enterprise routers use them at network boundaries, for example to keep a guest network away from management ports. Because they are stateless, writing one means thinking about both directions of every conversation, which is exactly the mistake the Server-to-Client ping in this lab shows. Router ACLs are a core topic in the CCNA.
Running it
Router ACLs: Interface Filtering opens on a canvas, already wired and addressed. Trace a packet through it hop by hop, or run the same topology live on real Linux network namespaces. How the two modes differ.
Open Router ACLs: Interface Filtering
Runs in your browser. No install, no signup, and the simulation starts instantly.
Open the lab →