1

I want to know if a firewall is considered an access control list (ACL). I know there are other types of ACLs, but am specifically interested in knowing if a firewall is an ACL.

Edit: It appears from the answer below that the firewall itself is not an ACL, but are the rules for the firewall considered an ACL?

  • Sure, in terms of (srcip,dstip:dstport) tuples, the firewall rules do read like an ACL. But it's a pretty ineffective one in the sense that srcip doesn't quite identify users, and dstip:dstport doesn't quite identify a resource. Particularly in the face of tunnels and NATs, you really need application layer support to lock down a resource to a particular user in a particular context. – Rob Dec 1 '14 at 14:49
10

A firewall its self is not an ACL. Typical firewalls are simply a hardware appliance with various interfaces on it. Firewalls use ACLs to filter traffic. By configuring different rules in the ACL you change the behavior of the firewall.

Software firewalls do also exist (windows firewall) but the behavior is much the same. It still has its own ACL that allows or denies traffic based on source, destination, and port.

  • Thank you for the quick response! Would the rules to the firewall then be considered an ACL? – Jonathan Jul 8 '14 at 19:24
  • 3
    Yes, a set of firewall rules can be thought of as an ACL. You get your list of rules together and apply that list to an interface. The firewall then filters the traffic based on those rules. The "Understanding Access Rules" section near the top of this page may clarify a bit more clearly. But the short answer is yes. – JekwA Jul 8 '14 at 20:40
  • 1
    Most "hardware" firewalls are software firewalls in disguise. The only type of FW which should be considered (somewhat) "hardware" is an ASIC based firewall. They are typically really fast. – goteguru Jun 15 '17 at 8:42

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.