Which type of access control is used on a router or firewall to limit network activity?

Mandatory access control uses sensitivity labels and clearance levels assigned by a central authority, typically found in government or military OS environments, not on network devices.

Discretionary access control allows resource owners to grant permissions to others, which is a file or object-level model and does not apply to router or firewall traffic filtering.

Rule-based access control (RuBAC) applies a set of administrator-defined rules to all subjects uniformly, regardless of identity or role. ACLs on routers and firewalls match traffic against ordered rule sets (permit/deny statements), making RuBAC the correct model for limiting network activity at the network layer.

Role-based access control grants access based on a user's organizational role, which is an identity-centric model and not the mechanism ACLs use to filter packets.