A computer implemented method to convert an ordered access control list to an unordered access control list, the method comprising: initializing a set of potentially permitted addresses to be a set of all possible addresses of an address range; initializing a set of actually permitted addresses to be empty; receiving an ordered access control list of ordered rules, wherein each of the ordered rules includes an address range and an action, wherein an address range includes a starting address and a mask, and, if two address ranges in the ordered rules overlap, a corresponding action of a preceding rule of the ordered rules overrides a corresponding action of a subsequent rule of the ordered rules for an overlapping range of addresses; converting the ordered access control list to the unordered access control list, wherein the unordered access control lists includes a plurality of independent rules and each of the plurality of independent rules includes a corresponding address range that is non-overlapping with other address ranges of the plurality of independent rules, wherein the converting includes, for each of the plurality of ordered rules in the ordered access control list, if the ordered rule is a deny rule, removing a deny address range of that deny rule from the set of potentially permitted addresses, and if that ordered rule is a permit rule, adding an overlapping portion between a permit address range of that permit rule and the potentially permitted set of addresses to the set of actually permitted addresses; generating the plurality of independent rules for the unordered access control list from the set of actually permitted addresses; and storing the unordered access control list, wherein the unordered access control list is used by a network element to make forwarding decisions for processing network data. initializing a set of potentially permitted addresses to be a set of all possible addresses of an address range; initializing a set of actually permitted addresses to be empty; receiving an ordered access control list of ordered rules, wherein each of the ordered rules includes an address range and an action, wherein an address range includes a starting address and a mask, and, if two address ranges in the ordered rules overlap, a corresponding action of a preceding rule of the ordered rules overrides a corresponding action of a subsequent rule of the ordered rules for an overlapping range of addresses; converting the ordered access control list to the unordered access control list, wherein the unordered access control lists includes a plurality of independent rules and each of the plurality of independent rules includes a corresponding address range that is non-overlapping with other address ranges of the plurality of independent rules, wherein the converting includes, for each of the plurality of ordered rules in the ordered access control list, if the ordered rule is a deny rule, removing a deny address range of that deny rule from the set of potentially permitted addresses, and if that ordered rule is a permit rule, adding an overlapping portion between a permit address range of that permit rule and the potentially permitted set of addresses to the set of actually permitted addresses; generating the plurality of independent rules for the unordered access control list from the set of actually permitted addresses; and storing the unordered access control list, wherein the unordered access control list is used by a network element to make forwarding decisions for processing network data.