ACLs: what gets through, what doesn't, and why
Every mechanism has a step-by-step animation, the configuration explained line by line and the exam notes. Where a parameter changes the outcome, you get a simulator in which you change it yourself.
TL;DR
An ACL is a list of permit / deny rules, read top to bottom: the first matching rule decides, and at the end an implicit deny drops everything else. Standard ACLs see only the source; extended ones also see the destination, the protocol and the ports; the wildcard says which bits of the address matter. Applied in or out on an interface, an ACL filters traffic passing through the router, but remembers nothing: replies must be permitted explicitly. The same ACL, used by NAT, PBR, QoS or CoPP, only selects traffic. Most incidents come from lines in the wrong order, the wrong direction, and control protocols forgotten in front of the implicit deny.
How to read the notes: red = critical for the exam, green = theory, blue = numbers, yellow = pitfalls, cyan = differences between platforms and standards. In the animations, the configuration lines used in the current step are highlighted automatically; the ← → arrows change the step when the animation is selected.
The analogy, in short
Think of the guard at a building's entrance, holding a rulebook: he reads it top to bottom, applies the first rule that matches, and on the last page it says, unseen, "nobody else gets in". The guard remembers nobody — whoever comes back needs a rule of their own too.
The model holds up to §7. From §8 onward (IPv6, fragments, hardware compilation) it breaks down; see the full analogy and its limits in §13.