Network ACL Overview

A network ACL is an optional layer of protection for your subnets. After you add inbound and outbound rules to a network ACL and associate subnets with it, you can control traffic in and out of the subnets.

A network ACL is different from a security group. A security group protects the instances in it, such as ECSs, databases, and containers, while a network ACL protects the entire subnet. Security groups are a mandatory layer of protection but network ACLs are optional. Network ACLs and security groups can be used together for fine-grained access control.

You need to specify the protocol, source port and address, and destination port and address for each inbound and outbound rule of the network ACL. Suppose you have two subnets in VPC-X of region A, as shown in Figure 1. Subnet-X01 is associated with network ACL Fw-A, and ECSs deployed in this subnet provide web services accessible from the Internet. Subnet-X02 is associated with network ACL Fw-B. Subnet-X02 and Subnet-Y01 are connected through a VPC peering connection. Now, you need to configure inbound and outbound rules to allow ECS-C01 in Subnet-Y01 to remotely log in to ECSs in Subnet-X02.

• Inbound and outbound rules of Fw-A:

  The custom inbound rule allows any IP address to access the ECSs in Subnet-X01 over port 80 using TCP (HTTP). If the traffic does not match the custom rule, the default rule is applied and the traffic is denied to enter the subnet.

  Stateful network ACLs allow responses to inbound requests to leave the subnet without being controlled by rules. The responses from ECSs in Subnet-X01 can leave the subnet. Other outbound traffic is denied to leave Subnet-X01 because the default rule is applied.

• Inbound and outbound rules of Fw-B:

  The custom rule in the inbound direction allows access from Subnet-Y01 to ECSs in Subnet-X02 through port 22 over TCP (SSH).

  The custom rule in the outbound direction allows all ICMP traffic over any port. The ping traffic from ECSs in Subnet-X02 can be routed to ECSs in Subnet-Y01 to test the network connectivity.

• Network ACL has inbound and outbound rules that are used to control traffic in and out of subnets.
  • Inbound rules control traffic sent to the instances in a subnet.
  • Outbound rules control traffic from the instances in a subnet to external networks.
• You need to define the protocol, source and destination ports, source and destination addresses, and other information for network ACL rules.
  • Rule Number: Network ACL rules are matched in ascending order, from the lowest to highest rule number.

    The default network ACL rule is marked with an asterisk (*) and is the very last rule that will be used for matching.

  • Status: Enabled or Disabled. Enabled rules are applied, while disabled rules are not.
  • Type: IPv4 or IPv6.
  • Action: Allow or Deny. If the protocol, source or destination port, and source or destination address of the traffic matches a network ACL rule, the action defined in the rule is taken to allow or deny the traffic.
  • Protocol: The protocol to match traffic. The value can be TCP, UDP, or ICMP.
    • TCP is ideal for applications that require reliable connections and high data integrity, such as remote login, web browsing, email, and file transfers.
    • UDP is ideal for applications demanding high speed and low latency, such as online gaming and video meetings.
    • ICMP is used by devices to communicate data transmission errors in a network. For example, ping can be used to test the connectivity between network devices, error reports can be generated for O&M, and diagnosis information can be transmitted for network analysis and optimization.
  • Source/Destination: The source or destination of the traffic.
  • Source Port Range/Destination Port Range: The source or destination ports and port ranges. The value ranges from 1 to 65535.

• After a network ACL is created, you can associate it with one or more subnets to control traffic in and out of the subnets. You can associate a network ACL with multiple subnets. However, a subnet can only be associated with one network ACL.
• Network ACLs use connection tracking to track traffic to and from instances. Changes to inbound and outbound rules do not take effect immediately for the existing traffic.

  If you add, modify, or delete a network ACL rule, or associate or disassociate a subnet with or from a network ACL, all the inbound and outbound persistent connections will remain connected. New rules will only be applied for the new connections.

• There are default inbound and outbound rules in network ACLs, as shown in Table 1. If a network ACL has no custom rules, the default inbound and outbound rules are applied, denying all traffic in and out of a subnet. You can use the default rules only when there is no need for traffic to go in and out of a subnet. If the traffic needs to go in and out of the subnet, you need to add custom rules to control traffic as required.

  Table 1 Default network ACL rules

  Direction	Rule Number	Action	Protocol	Source	Source Port Range	Destination	Destination Port Range
  Inbound	*	Deny	All	0.0.0.0/0	All	0.0.0.0/0	All
  Outbound	*	Deny	All	0.0.0.0/0	All	0.0.0.0/0	All

• The default and custom rules of a network ACL do not apply to the traffic described in Table 2.

  Table 2 Traffic not limited by network ACL rules

  Direction	Description
  Inbound	Traffic between the instances in the same subnet
  	Broadcast traffic to 255.255.255.255/32
  	Multicast traffic to 224.0.0.0/24
  Outbound	Traffic between the instances in the same subnet
  	Broadcast traffic to 255.255.255.255/32
  	Multicast traffic to 224.0.0.0/24
  	TCP metadata traffic to 169.254.169.254/32 over port 80
  	Traffic to 100.125.0.0/16 that is reserved for public services on the cloud, such as the DNS server addresses and NTP server addresses

A subnet can be associated with one network ACL. If there are multiple rules in a network ACL, rules are applied based on their priority. A smaller number indicates a higher priority. The value of the default rule priority is *, which has the lowest priority.

A subnet can be associated with only one network ACL. If there are multiple rules on the network ACL, rules are matched in ascending order, from the lowest to highest rule number. The default network ACL rule is marked with an asterisk (*) and is the very last rule that will be used for matching.

The matching sequence of inbound traffic is the same as that of outbound traffic. The following takes inbound traffic as an example to describe how the rules are applied.

• If a custom rule is matched and the Action of the rule is set to:
  • Deny, the traffic is denied to flow into the subnet.
  • Allow, the traffic is allowed to flow into the subnet.
• If no custom rule is matched, the default rule is applied, denying traffic from flowing into the subnet.

• If the application layer needs to provide services for external users, traffic from all IP addresses must be allowed to reach the application layer. However, you also need to prevent illegal access from malicious users.

  Solution: You can add network ACL rules to deny access from malicious IP addresses.

• How can I isolate ports with identified vulnerabilities? For example, how do I isolate port 445 that can be exploited by WannaCry worm?

  Solution: You can add network ACL rules to deny access over a specific port and protocol, for example, port 445 and TCP.

• There is no need to control east-west traffic between subnets, but there is a need to control north-south traffic between subnets.

  Solution: You can add network ACL rules to control north-south traffic between subnets.

• For frequently accessed applications, rule sequences may need to be adjusted to improve performance.

  Solution: A network ACL allows you to adjust the rule sequence so that frequently used rules are applied before other rules.

• By default, each account can have up to 200 network ACLs in a region.
• A network ACL can have no more than 20 rules in each direction, or the performance will deteriorate.
• Traffic from load balancers is not limited by network ACL and security group rules if:

  Transfer Client IP Address is enabled for the listeners of a load balancer.

  The load balancer can still forward traffic to backend servers, even if there is a rule that denies traffic from the load balancer to the backend servers.