Cisco IOS ACL calculator

Recent changes, 12-21-05

Now generates "range" statements when given a range of port numbers separated with a hyphen, e.g. xxx-yyy.
Fixed a bug in finding CIDR blocks that prevented it from correctly generating /31 groups

Known limitations and bugs:

Address ranges must be supplied in ascending order, e.g. 10.10.10.10-10.10.20.20. If you use 10.10.20.20-10.10.10.10 it won't handle that (though the elements of a comma-separated list can be in any order, I believe).
Currently there is no way to specify a combination of permit and deny rules in the same ACL. Generate them separately and edit them together by hand. (The original motivation behind this code was the optimization of subnetting; it's assumed that the logic of ACL processing is not an issue.)

Please report bugs or erroneous output to chd@chud.net.

My desired rule is to:

Permit traffic
Deny traffic

Source and destination addresses may be specified in any combination of three syntaxes: a single IP address, a range of addresses in the format a.a.a.a-b.b.b.b or a.a.a.a-b, or a CIDR block in the format x.x.x.x/nn. You may supply a comma-separated list of any or all of these formats. Use the word "any" to specify all addresses. For example, all of the following are legal:

10.10.10.20
10.10.10.10-200
20.20.20.20-30.30.30.30,10.10.10.20,10.10.10.10-200
10.10.10.10/8,45.45.45.45

Ports refer to TCP or UDP port. The valid range is 0-65535; see below for a list of which port is used by various known services.

Ports may be specified as a singe port, a range of ports in the form xxxx-yyyy, or a comma separated list of any combination of those.

Any fields left blank are presumed to be "any".

Source address, address range, list, and/or "any":

Source port, range, list, and/or "any":

Destination address, address range, list, and/or "any":

Destination port, range, list, and/or "any":

Protocol:
TCP
UDP
All IP protocols

But I don't know what port number is used by the service I need!

That's okay - here's the list! (Note: this is an excerpt from the larger RFC1700.)

Source address, address range, list, and/or "any":
Source port, range, list, and/or "any":

Destination address, address range, list, and/or "any":
Destination port, range, list, and/or "any":