6.6. Access Control Lists (ACLs)

💡 First Principle: Without ACLs, every packet flows everywhere—your guest WiFi can reach your financial servers, your printers can talk to the internet, anyone can SSH to your routers. ACLs are the bouncers of your network: they check each packet against a list of rules and decide whether to permit or deny.

What breaks without ACLs: Imagine a disgruntled contractor on your guest network running a port scan. Without ACLs, they can probe every server, try default credentials on every device, and exfiltrate data to any external server. ACLs create boundaries—they enforce the principle that "just because you're on the network doesn't mean you can reach everything."

The critical insight: order matters. ACLs process rules top-to-bottom and stop at the first match. Consider this scenario: you want to permit HTTP but deny all other traffic. If you write "deny all" first, HTTP gets blocked—the deny matched before the permit was checked. Rule order isn't a detail; it's the difference between working and broken.