Network ACL
#16 · Level 1 · Core services · Networking basicsConcept
Section titled “Concept”A Network ACL is a security checkpoint placed at the gate of a whole subnet. It checks all traffic entering and leaving the subnet. You can write both kinds of rules in it — allow and deny — and the rules are matched in order of their numbers. A Network ACL is stateless, so incoming and outgoing traffic need separate rules. Together with Security Groups, it adds an extra layer of security.
Simple example
Section titled “Simple example”If a Security Group is the guard at a flat’s door, a Network ACL is the guard at the main gate of the whole building. You are checked once when entering the building, and again when entering the flat.
Why it’s needed
Section titled “Why it’s needed”It is an extra layer of security. It is useful for blocking a specific bad IP address from the whole subnet at once.
Where it’s used
Section titled “Where it’s used”In most cases the default settings are enough. It is used when some particular traffic needs to be blocked.
Azure equivalent
Section titled “Azure equivalent”Network Security Group (NSG) attached to a subnet
Related
Section titled “Related”Learn more
Section titled “Learn more”For details and the latest information, see the official documentation: