Atlas Docs

Network ACLs

Properties1
aliasesNetwork ACLs, Networking/Network ACLs

2 min read

Network ACLs

Network Access Control Lists (ACLs) act as a stateless firewall for controlling traffic in and out of subnets (tiers) within a VPC. Unlike Security Groups, which operate at the instance level, Network ACLs apply to all traffic entering or leaving a subnet.

Key Characteristics

  • Stateless: Responses to allowed inbound traffic are subject to outbound rules (and vice versa). You must explicitly allow return traffic (e.g., ephemeral ports).
  • Subnet-Level: Rules apply to the entire subnet, affecting all instances within it.
  • Ordered Evaluation: Rules are processed in numerical order (lowest number first). The first matching rule determines the action (Allow/Deny).
  • Default Deny: By default, a new ACL list denies all traffic until rules are added.

Creating an ACL List

  1. Navigate to Network > Network ACL Lists.
  2. Click Add ACL List.
  3. Name: Provide a descriptive name (e.g., “Web-Public-Inbound”).
  4. VPC: Select the VPC where this list will be used.

Adding Rules

Once the list is created, click on it to add rules:

  • Number: The priority (1-999). Lower numbers are evaluated first.
  • CIDR: The source IP range for Ingress (e.g., 0.0.0.0/0 for internet) or destination for Egress.
  • Action: Allow or Deny.
  • Protocol: TCP, UDP, ICMP, or All.
  • Port Range: Single port (80) or range (1024-65535).
  • Traffic Type: Ingress (Inbound) or Egress (Outbound).

Example Configuration: Web Tier

Ingress Rules:

  1. Prio 100: Allow TCP 80 from 0.0.0.0/0 (HTTP)
  2. Prio 110: Allow TCP 443 from 0.0.0.0/0 (HTTPS)
  3. Prio 120: Allow TCP 22 from YOUR_OFFICE_IP/32 (SSH Management)

Egress Rules:

  1. Prio 100: Allow TCP 1024-65535 to 0.0.0.0/0 (Ephemeral return traffic)
  2. Prio 110: Allow TCP 80/443 to 0.0.0.0/0 (Software updates)
  3. Prio 120: Allow UDP/TCP 53 to 0.0.0.0/0 (DNS resolution)

Associating with a Network

To apply the rules:

  1. Navigate to Network > VPC.
  2. Select your VPC and go to the Networks tab.
  3. Edit the desired Tier (Subnet).
  4. Change the ACL dropdown to your new list.
  5. Save. The changes apply immediately.

Backlinks