Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I am trying to understand ACLs and am unsure of where they are applied.

Here's my example. I am trying to prevent communication between two VLAN interfaces.

My source clients are on VLAN 1, my destination servers are on VLAN 2. I want to prevent the clients from communicating with the servers. I am only able to apply inbound ACLs.

Do I apply the ACL on the VLAN 1 interface or the VLAN 2 interface?

share|improve this question
On what platform, on a switch like a Cisco, or on a linux box etc? – Chopper3 Feb 2 '11 at 10:42
Network hardware - we have Dell and Cisco, but I think they work the same way. – dunxd Feb 2 '11 at 10:47
up vote 1 down vote accepted

You apply the ACL in your case to VLAN1 as that is the interface where the traffic you want to control enters your router/switch.

Think about the problem from the perspective of the filtering device, rather than the traffic source - traffic is incoming to the device from VLAN1 and outgoing to VLAN2.

share|improve this answer
Thanks for the info. Damn - VLAN1 is the production network, so I can't do much experimentation there. I wish that the Dell 62xx switches supported egress IP filtering, which presumably would allow me to block access coming out of VLAN 2. – dunxd Feb 3 '11 at 10:35
You could block traffic from the servers back to the clients, not perfect but it would effectively prevent communication from happening, but not prevent the clients on VLAN1 attacking the servers with DoS type attacks. – James Yale Feb 3 '11 at 11:38

If you are using standard ACL's who only use IP addresses it should be close to the source while extended ACL's are usually used closed to the destination.

You can find more info here:

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.