ACL builder
Create a Cisco extended access list from simple rules, with wildcard masks worked out for you.
Runs on your device · nothing is uploaded
Addresses: any, a single IP such as 10.1.1.10, or a network in CIDR such as 10.0.0.0/24 (converted to a wildcard mask for you). Ports: 443, 80,443 or a range 1000-2000. Rules are checked top to bottom and the first match wins.
Building safe access lists
An access control list (ACL) is checked from the top down and the first matching line wins. Anything that matches no line is dropped by the invisible "deny any" at the end. This builder turns simple rules into a named extended ACL and the command to apply it to an interface.
Good habits
- Be specific: exact source, destination and port beat "permit ip any any".
- Order matters: put specific rules above general ones.
- Add remarks so the next engineer knows why each line exists.
- Extended ACLs go close to the source; standard ACLs close to the destination.
- Test first with
show access-listshit counters, and keep console access in case you lock yourself out.
Need the wildcard for a mask? Use the wildcard mask calculator, or read ACLs and wildcard masks.