Help Center/ Virtual Private Cloud/ Service Overview/ Basic Concepts/ Network ACL
Updated on 2026-07-28 GMT+08:00
View PDF

Network ACL

A network ACL is an optional layer of protection for your subnets. After you add inbound and outbound rules to a network ACL and associate subnets with it, you can control traffic in and out of the subnets.

A network ACL is different from a security group. A security group protects the instances in it, such as ECSs, databases, and containers, while a network ACL protects the entire subnet. Security groups are a mandatory layer of protection but network ACLs are optional. Network ACLs and security groups can be used together for fine-grained access control.

You need to specify the protocol, source port and address, and destination port and address for each inbound and outbound rule of the network ACL. Suppose you have two subnets in VPC-X of region A, as shown in Figure 1. Subnet-X01 is associated with network ACL Fw-A, and ECSs deployed in this subnet provide web services accessible from the Internet. Subnet-X02 is associated with network ACL Fw-B. Subnet-X02 and Subnet-Y01 are connected through a VPC peering connection. Now, you need to configure inbound and outbound rules to allow ECS-C01 in Subnet-Y01 to remotely log in to ECSs in Subnet-X02.
  • Inbound and outbound rules of Fw-A:

    The custom inbound rule allows any IP address to access the ECSs in Subnet-X01 over port 80 using TCP (HTTP). If the traffic does not match the custom rule, the default rule is applied and the traffic is denied to enter the subnet.

    Stateful network ACLs allow responses to inbound requests to leave the subnet without being controlled by rules. The responses from ECSs in Subnet-X01 can leave the subnet. Other outbound traffic is denied to leave Subnet-X01 because the default rule is applied.

  • Inbound and outbound rules of Fw-B:

    The custom rule in the inbound direction allows access from Subnet-Y01 to ECSs in Subnet-X02 through port 22 over TCP (SSH).

    The custom rule in the outbound direction allows all ICMP traffic over any port. The ping traffic from ECSs in Subnet-X02 can be routed to ECSs in Subnet-Y01 to test the network connectivity.

Figure 1 Network ACL rules
Parent topic: Basic Concepts