This Cisco ACL generator builds IOS access lists from simple rule rows. You write networks in CIDR and it writes the address and wildcard pairs, sequence numbers, remarks and the interface command. It runs entirely in your browser: nothing you type is sent to our server.
Loading the tool… It runs in your browser and needs JavaScript.
Table of Contents
How to use it
- Choose standard (source only) or extended (protocol, source, destination and ports), named or numbered.
- Add rules top to bottom. Use
any, a single IP or a CIDR block; /32 becomeshost. - Ports apply to tcp and udp only: eq, neq, gt, lt or range (two ports). Names such as www or ssh work too.
- Tick log on rules you want to see hits for, and keep the final explicit deny with log to find what you forgot.
ACL rules to remember
- ACLs are processed top-down and stop at the first match; put specific rules before general ones.
- Every ACL ends with an implicit deny any: anything not permitted is dropped.
- Numbered ranges: standard 1-99 and 1300-1999, extended 100-199 and 2000-2699.
- Apply new ACLs from the console, or schedule
reload in 10first, so a mistake cannot lock you out of a remote router.
For masks only, use the wildcard mask calculator. For Linux servers, see CSF commands.
How we checked it
We checked the generated syntax for named and numbered, standard and extended ACLs on 11-12 October 2026, including CIDR to wildcard conversion, host entries, port operators and the number-range validation.
Frequently asked questions
What is the difference between standard and extended ACLs?
Standard ACLs match only the source address. Extended ACLs match protocol, source, destination and ports.
Where should I apply an extended ACL?
Close to the source of the traffic you want to filter, so it is dropped before crossing the network. Standard ACLs go close to the destination.
How do I convert a CIDR to an ACL entry?
Use the network address and the wildcard mask: 10.0.0.0/24 becomes 10.0.0.0 0.0.0.255. The generator does this for every rule.