Adding a Network ACL Rule (Default Priorities)
Scenarios
You can add inbound and outbound rules to a network ACL to control the traffic in and out of a subnet.
When you perform the following operations to add a rule, the system generates a priority based on the sequence when the rule is added. You cannot specify a priority.
As shown in Table 1, there are two custom inbound rules (rule A and rule B) and one default rule. The priority of rule A is 1 and that of rule B is 2. The default rule has the lowest priority. If rule C is added, the system sets its priority to 3, which has lower priority than rules A and B and higher priority than the default rule.
Priorities (Rules A and B) |
Priorities (Rules A, B, and C) |
||
---|---|---|---|
Custom rule A |
1 |
Custom rule A |
1 |
-- |
-- |
Custom rule B |
2 |
Custom rule B |
2 |
Custom rule C |
3 |
Default rule |
* |
Default rule |
* |
If the default priorities do not meet your requirements, you can customize the priorities by referring to Adding a Network ACL Rule (Custom Priorities).
Notes and Constraints
A network ACL can contain up to 100 rules in one direction, or performance will deteriorate.
Procedure
- Log in to the management console.
- Click
in the upper left corner and select the desired region and project.
- Click
in the upper left corner and choose Networking > Virtual Private Cloud.
The Virtual Private Cloud page is displayed.
- In the navigation pane on the left, choose Access Control > Network ACLs.
The network ACL list is displayed.
- In the network ACL list, locate the target network ACL and click its name.
The network ACL summary page is displayed.
- On the Inbound Rules or Outbound Rules tab, click Add Rule.
The Add Inbound Rule or Add Outbound Rule dialog box is displayed.
- Configure required parameters.
- Click
to add more rules.
- Locate the row that contains the network ACL rule and click Replicate in the Operation column to replicate an existing rule.
Table 2 Parameter descriptions Parameter
Description
Example Value
Type
Network ACL type. There are two options:- IPv4
- IPv6
IPv4
Action
The action in the network ACL. There are two options:- Allow: allows matched traffic in and out of a subnet.
- Deny: denies matched traffic in and out of a subnet.
Allow
Protocol
The protocol supported by the network ACL to match traffic. The value can be TCP, UDP, or ICMP.
TCP
Source
The source from which the traffic is allowed. The source can be an IP address or IP address range.
- IP address:
- Single IP address: 192.168.10.10/32 (IPv4); 2002:50::44/128 (IPv6)
- All IP addresses: 0.0.0.0/0 (IPv4); ::/0 (IPv6)
- IP address range: 192.168.1.0/24 (IPv4); 2407:c080:802:469::/64 (IPv6)
192.168.0.0/24
Source Port Range
The source port or port range used to match traffic. The value ranges from 1 to 65535.
22-30
Destination
The destination to which the traffic is allowed. The destination can be an IP address or IP address range.
- IP address:
- Single IP address: 192.168.10.10/32 (IPv4); 2002:50::44/128 (IPv6)
- All IP addresses: 0.0.0.0/0 (IPv4); ::/0 (IPv6)
- IP address range: 192.168.1.0/24 (IPv4); 2407:c080:802:469::/64 (IPv6)
0.0.0.0/0
Destination Port Range
The destination port or port range used to match traffic. The value ranges from 1 to 65535.
22-30
Description
Supplementary information about the network ACL rule. This parameter is optional.
The description can contain a maximum of 255 characters and cannot contain angle brackets (< or >).
N/A
- Click
- Click OK.
Return to the rule list to check the new rule.
- The system generates priorities based on the sequence when rules are added. The rule that is added earlier is preferentially matched.
- If the status of the new rule is Enabled, the rule is applied.
Feedback
Was this page helpful?
Provide feedbackThank you very much for your feedback. We will continue working to improve the documentation.