Access control mechanism for routers

A method and apparatus are provided for maintaining access control lists (ACLs) within TCAM on a line card in a data packet router, the rules being applied to incoming data packets. Each interface (14,16,18,20) may be associated with multiple ACLs, and multiple interfaces may be associated with single shared ACLs (28a,28b). The shared ACLs include rules applicable to more than one interface. Other ACLs (26) are specific to a particular interface. When searching for a rule to apply to an incoming data packet, the filter searches both the specific ACL and the shared ACLs associated with the interface over which the data packet arrived. Using the shared ACLs, duplication of common rules is reduced, thereby reducing the total number of rules stored on the line card and saving memory storage space. The invention is also applicable to sets of rules other than ACLs.