Rule Overview

Rule Overview

The network access control list (ACL) is an optional security layer at the subnet level, which is used to control the data flow entering and leaving the subnet and can be accurate to the protocol and port granularity.

Use Cases

You can associate the same network ACL for subnets with the same network traffic control and precisely control the traffic entering and leaving the subnet by setting outbound and inbound rules.
For example, suppose you host multi-layer web applications in the VPC of the cloud platform and create different subnets to deploy web layer, logical layer, and data layer services, respectively, through the network ACL. In that case, you can control access between these three subnets so that the web layer subnet and the data layer subnet cannot access each other. Still, only the logical layer can access the web layer and the data layer subnet.

ACL Rules

When you add or delete a rule in the network ACL, it is automatically applied to the network flow control of its associated subnet.
Network ACL rules include inbound and outbound rules, which are composed of the following:

• Source/Destination IP: source/destination IP of traffic. If it is an inbound rule, you need to enter the source IP; if it is an outbound rule, you need to enter the destination IP. Both source and destination IPs support the following format:
  • Single IP address: 192.168.0.1 or FF05::B5
  • CIDR: 192.168.1.0/24 or FF05:B5::/60
  • All IPv4 addresses: 0.0.0.0/130618222416261120
  • All IPv6 addresses: 0::0/130618222416261120 or ::/130618222416261120
• Protocol type: Select the protocol type allowed/denied by ACL rules, such as TCP and UDP.
• Port: source/destination port of traffic. The port supports the following formats:
  • Single port: e.g. 22 or 80
  • Continuous port: e.g. 1-65535 or 100-20000
  • All ports: ALL
• Policy: Allow or deny.

Default Rules

Once created, every network ACL has two default rules that cannot be modified or deleted, with the lowest priority.

• Default Inbound Rule

• Default Outbound Rule.

Rule Priority

• The priority of network ACL rules is indicated by the position of the rule in the list. The rule at the top of the list has the highest priority and is applied first, while that at the bottom of the list has the lowest priority.
• If there is a rule conflict, the rule with the higher priority will prevail by default.
• When traffic enters or leaves a subnet bound to a network ACL, it matches against the rules from the top of the network ACL list to the last. If a rule is successfully matched and allows passage, subsequent rules are not matched.

Application Example

Example: To allow all source IPs to access all ports on the CVM within the ACL-associated subnet while denying HTTP service access on port 80 from the server source IP 192.168.200.11/24, you can add the following two network ACL inbound rules:

Difference Between Security Group and Network ACL