Access Control List (ACL)
Access Control Lists (ACL) define how network traffic is allowed or denied inside a VPC.
Every subnet in a VPC is associated with an ACL, and all Virtual Machines inside that subnet inherit its rules.
ACLs act as a network-level firewall, controlling traffic before it reaches the VM.
What You Can Control with ACLs
With ACL rules, you can control traffic based on:
- Direction
- Ingress - traffic entering resources in the subnet
- Egress - traffic leaving resources in the subnet
- Protocol
- TCP
- UDP
- Source CIDR
- Specific IP ranges (for example,
203.0.113.0/24) - Allow all (
0.0.0.0/0)
- Specific IP ranges (for example,
- Port Range
- Single ports (e.g.
22,443) - Port ranges (e.g.
3000–4000)
- Single ports (e.g.
- Action
- Allow
- Deny
These rules apply uniformly to all VMs within the subnet.
Default ACL Behavior
When a new VPC is created, CloudRaya automatically applies default ACL rules to ensure basic connectivity.
By default, commonly used ports such as:
- SSH (
22) - HTTP (
80) - HTTPS (
443) - RDP (
3389)
are allowed for ingress traffic.
You can:
- Modify existing rules
- Add new rules
- Remove unnecessary rules
to match your security requirements.
ACL Profiles Are Reusable
An ACL is not locked to a single subnet forever. Each VPC can have multiple ACL profiles, and the same profile can be attached to more than one subnet at the same time.
This is useful when several subnets serve the same application or have identical access requirements. You can define the rules once and reuse the same profile, instead of recreating identical rules for each subnet.
Because a profile can be shared, editing its rules affects every subnet currently using it, not just one.
Changing the ACL Attached to a Subnet
You can change which ACL profile a subnet uses at any time, without recreating the subnet.
Steps
- Go to Dashboard → Network → VPC
- Click View Detail on the relevant VPC
- On the Subnet tab, click the edit icon next to the subnet's current ACL
- In the Change ACL dialog, select a different ACL profile, or click + New ACL Rules to create one
- Click Update VPC
Viewing Which Subnets Use an ACL Profile
The Access List tab on the VPC Detail page lists every ACL profile created for that VPC, along with the subnet(s) currently attached to each one.
Use this view to check which subnets would be affected before editing a shared ACL profile.
ACL Profiles Are Scoped to a VPC
ACL profiles belong to the VPC they were created in. A profile created in one VPC cannot be attached to a subnet in a different VPC, even within the same Cloud Zone. Each VPC maintains its own independent list of ACL profiles.
How ACLs Work with Virtual Machines
ACLs operate at the VPC subnet level, not at the individual VM level.
This means:
- VMs do not have their own ACLs
- All VMs in the same subnet share the same ACL rules
- Changing an ACL affects all VMs attached to that subnet
For VM-specific firewall configuration (such as application ports or OS-level filtering), you should configure firewall rules inside the operating system.
📄 See: VM Networking Basics
Ingress vs Egress Rules
| Rule Type | Controls | Example |
|---|---|---|
| Ingress | Traffic entering the subnet | Allow HTTP (80) from the internet |
| Egress | Traffic leaving the subnet | Allow outbound access to external APIs |
Best practice is to:
- Keep ingress rules restrictive
- Allow only the ports your application actually needs
- Monitor and tighten egress rules when required
Common Use Cases
- Allow SSH access only from a specific office IP
- Expose web applications using ports 80 and 443
- Block unnecessary outbound traffic
- Separate public-facing and internal workloads using different subnets and ACLs
Important Notes
- ACL rules are evaluated at the network level
- Incorrect rules may block access to all VMs in a subnet
- Always review ACL changes carefully before applying them in production environments
- Reused ACL profiles affect every subnet attached to them; check the Access List tab before editing a shared profile