Access Control Lists (ACLs) determine which sources are permitted to access to a given service on DAL OS devices, such as its Web User Interface (webU) or SSH server.
ACLs are configured in the Services area of the device's settings. Each service has its own ACL subsection.
When configuring a service's ACL, you can specify one or more of the following: IPv4 Addresses, IPv6 Addresses, Interfaces, and Zones.
A common misconception is that these sections are evaluated in a hierarchy. In reality, the ACL sections are mutually inclusive. If an access attempt matches any configured ACL rule for the service, access is allowed.
This means ACL entries are evaluated using "OR" logic. Adding additional ACL entries generally expands the set of allowed sources rather than narrowing it.
How ACL Evaluation Works
Access is allowed if any configured ACL entry matches the incoming connection to the service in question.
Think of it like this:
IPv4 Address match -OR- IPv6 Address match -OR- Interface match -OR- Zone match
List of the ACL Sections:
Zones
Zones allow access based on the firewall zone from which traffic arrives. If a service ACL includes the External zone, any connection arriving through an interface assigned to the External zone is allowed to access the service.
Interfaces
Interfaces allow access based on the ingress interface. If a service ACL includes a specific interface, traffic arriving on that interface is allowed to access the service.
IPv4 and IPv6 Addresses
IP address entries provide granular control by allowing access from specific addresses or networks. If the source IP matches a configured entry, access is allowed.
NOTE: If there are no entries within any of the ACL sections of a given service, that means that there is no filtering occurring, i.e. access to that service is permitted from any IP address via any interface, and independent of any zones that any interface may be tied to!
Common Source of Confusion
Example ACL configuration:
Zones: External, IPv4 Addresses: 192.168.1.0/24
Many users expect only 192.168.1.0/24 to be allowed. However, because, DAL OS ACLs use "OR" logic, access is allowed if the source IP is in 192.168.1.0/24 -OR- the traffic arrives from an interface that's tied to the External zone.
As a result, any IP address arriving on an interface assigned to the External zone is allowed to access the service, effectively broadening access beyond the IPv4 restriction.
Troubleshooting Unexpected Access
If access is being allowed unexpectedly, review all ACL sections for the service in question. A connection only needs to match one configured ACL entry to be permitted.
Last updated:
Oct 19, 2026