How do you implement an allow-list based firewall rule set using an address-list?

How do you implement an allow-list based firewall rule set using an address-list?

• A. /ip firewall filter add chain=input action=drop; /ip firewall address-list add list=allowed-subnet address=192.168.0.0/16; /ip firewall filter add chain=input src-address-list=allowed-subnet action=accept
• B. /ip firewall filter add chain=input action=drop; /ip firewall address-list add list=allowed-subnet address=192.168.0.0/16; /ip firewall filter add chain=input src-address-list=allowed-subnet action=accept
• C. /ip firewall address-list add list=blocked-subnet address=10.0.0.0/8; /ip firewall filter add chain=input src-address-list=blocked-subnet action=drop; /ip firewall filter add chain=input action=accept
• D. /ip firewall address-list add list=allowed-subnet address=192.168.0.0/16; /ip firewall filter add chain=input src-address-list=allowed-subnet action=accept; /ip firewall filter add chain=input action=drop

Answer: (C)

Using an address-list to control access means you keep a named list of addresses and write firewall rules that refer to that list. The important detail is rule order: the rule that accepts traffic from the listed addresses must be evaluated before a final drop, so allowed sources aren’t blocked by a later rule. In this setup, a list called blocked-subnet is created and populated with 10.0.0.0/8. A filter rule then drops any input traffic whose source is in that list. A final rule accepts all other input traffic. The effect is that traffic from 10.0.0.0/8 is denied, and everything else is allowed. This demonstrates using an address-list to define a set to deny and then a catch-all allow, which is a practical way to realize an allow-list pattern by explicitly listing what to block and permitting the rest. For a stricter allow-list where you explicitly enumerate allowed sources, you would define an allowed-address list and place an accept rule for that list before a final drop, ensuring non-listed sources are blocked. The key idea remains: reference the address-list in the rule and order the accept-before-drop correctly.

Using an address-list to control access means you keep a named list of addresses and write firewall rules that refer to that list. The important detail is rule order: the rule that accepts traffic from the listed addresses must be evaluated before a final drop, so allowed sources aren’t blocked by a later rule.

In this setup, a list called blocked-subnet is created and populated with 10.0.0.0/8. A filter rule then drops any input traffic whose source is in that list. A final rule accepts all other input traffic. The effect is that traffic from 10.0.0.0/8 is denied, and everything else is allowed. This demonstrates using an address-list to define a set to deny and then a catch-all allow, which is a practical way to realize an allow-list pattern by explicitly listing what to block and permitting the rest.

For a stricter allow-list where you explicitly enumerate allowed sources, you would define an allowed-address list and place an accept rule for that list before a final drop, ensuring non-listed sources are blocked. The key idea remains: reference the address-list in the rule and order the accept-before-drop correctly.