Network ACLs

Limitations

• You can create only one network ACL per VPC.

• Only IPv4 is supported.

Create network ACL

1. Log on to the ENS console.

2. In the left-side navigation pane, click the icon next to Network Management, and then click Network ACLs.

3. On the Network ACLs page, click Create Network ACL. Enter the required information and click Create.

   Note

   When you create a network ACL, you can configure custom rules. For more information, see Network ACL rules.

Associate network ACL

1. In the left-side navigation pane, click Network Management > Networks.

2. On the Networks page, find the target network, click the icon to its right, and choose Associate Network ACL. In the dialog box that appears, select the network ACL and click OK.

View associated instances

1. In the left-side navigation pane, click the icon next to Network Management, and then click Network ACLs.

2. Click the target network ACL or click Manage in the Actions column on the right, and select Associated Resources to view the bound instances. Click the ID of the target network ACL to go to the details page, and click the Bound Resources tab to view the network resources that are bound to the network ACL, including information such as the network and vSwitch ID/name, node, status, network ID, and destination CIDR block.

Delete network ACL

1. In the left-side navigation pane, click the icon next to Network Management, and then click Network ACLs.

2. Find the target network ACL and click Delete in the Actions column.

Manage network ACL rules

1. In the left-side navigation pane, click the icon next to Network Management, and then click Network ACLs.

2. Click the target network ACL or click Manage in the Actions column. You can create, delete, or edit rules.

   Note

   You can create, delete, and update rules in batches. After you perform a batch operation, a dialog box appears for you to confirm the changes. Single operations do not require confirmation.

Inbound rules

• You can create up to 20 rules for each direction.

• When you create a network ACL, the system creates two inbound rules by default.

  • Source: 100.64.0.0/10. This rule is used for internal cloud services. We recommend that you do not delete this rule. If you delete it, you cannot access internal cloud services.

  • Source: 0.0.0.0/0. This rule allows all inbound traffic. If you delete this rule, network connectivity may be affected.

Outbound rules

• You can create up to 20 rules for each direction.

• When you create a network ACL, the system creates one outbound rule by default.

  • Source: 0.0.0.0/0. This rule allows all outbound traffic. If you delete this rule, network connectivity may be affected.

How rules work

• Each rule has a priority from 1 (highest) to 100 (lowest). Rules are evaluated in ascending order of priority. When traffic matches a rule, the system immediately applies its allow or deny action and stops further evaluation.

  Note

  If multiple rules have the same priority, the deny rule takes precedence.

• Whether network ACL rules are stateful or stateless depends on the protocol. See the following table for details:

  Note

  When you create a network ACL, the system automatically generates default rules that allow all traffic. The behavior described in the following table assumes these default rules have been deleted.

  Protocol	Inbound	Outbound
  UDP	If you configure an inbound allow rule, you must also configure an outbound allow rule for the response traffic.	If you configure an outbound allow rule, you must also configure an inbound allow rule for the response traffic.
  TCP	Stateful. You do not need to configure an allow rule for the response traffic.
  ICMP	Stateless. You must configure allow rules for traffic in both directions.