Security & VPN
Access Lists & NAT
The two edge tools every network still runs on: access control lists — ordered permit/deny filters evaluated top-down against packets — and network address translation, which stretched IPv4 far past its design life and complicates every protocol that embeds addresses.
- read in order, or dip in
- 2 chapters
- updated 31 Aug 2026
- Free — no signup
read in order, or dip in
updated 31 Aug 2026
Contents
- 01Standard and Extended ACLs ExplainedAn ACL is an ordered list of permit and deny statements evaluated top-down against each packet — first match wins, and an invisible implicit deny discards anything unmatched. Standard ACLs match only source address and belong near the destination; extended ACLs match protocol, both addresses and ports, and belong near the source; wildcard masks, not subnet masks, define the matched ranges.
- 02NAT Explained: Static, Dynamic and PATNAT rewrites packet addresses at a border router: static NAT maps one inside host to one public address permanently, dynamic NAT draws from a pool, and PAT — port address translation, the home and enterprise default — multiplexes an entire private network behind one public address by tracking sessions in a translation table keyed on ports. It stretched IPv4 for decades, at the price of breaking end-to-end addressing.
Spotted something out of date? Tell us — this library is maintained by the faculty.