An access control method, performed by a client proxy apparatus running on a terminal device, includes intercepting a first negotiation packet. The first negotiation packet is from a first application client on the terminal device and is used to perform negotiation to establish a first session. The first session is between the first application client and a first server. The first session meets an encryption strength requirement. The method also includes adding authentication information corresponding to the first application client to a transport layer packet header of the first negotiation packet to obtain a modified first negotiation packet. The method further includes sending the modified first negotiation packet to a gateway device.