Creating and Managing a User-defined Network ACL

Create a User-defined Network ACL

Each user can create a maximum of 200 user-defined network ACLs by default.

  1. Log in to the management console.
  2. Under Computing, click Bare Metal Server.

    The BMS console is displayed.

  3. Click the User-defined Networks tab and click Create User-defined Network ACL.
  4. Enter a name and description and click OK.
  5. After the user-defined network ACL is created successfully, it is displayed in the list of user-defined network ACLs.

Add an Inbound/Outbound Rule

Add an inbound or outbound rule based on your network security requirements.

  1. On the BMS console, click the User-defined Networks tab and select User-defined Network ACLs.
  2. Click the name of the target user-defined network ACL.
  3. On the Inbound Rules or Outbound Rules tab, click Add Rule to add an inbound or outbound rule.

    You can click + to add more rules.

    Table 1 Parameter description

    Parameter

    Description

    Policy

    Specifies the policy of the user-defined network ACL. This parameter is mandatory. You can select a value from the drop-down list.

    Protocol

    Specifies the protocol supported by the user-defined network ACL. This parameter is mandatory. You can select a value from the drop-down list. Currently, only TCP, UDP, ICMP, and All protocols are available. If you select ICMP or All protocols, port information cannot be specified.

    Source

    Specifies the source IP address from which the traffic is permitted.

    The default value is 0.0.0.0/0, which indicates that traffic from all IP addresses is permitted.

    For example:

    xxx.xxx.xxx.xxx/32 (IP address)

    xxx.xxx.xxx.0/24 (CIDR block)

    0.0.0.0/0 (any IP address)

    Source Port Range

    Specifies the source port number or port number range. The value ranges from 1 to 65535. For a port number range, enter two port numbers connected by a hyphen (-), such as 1-100.

    You must specify this parameter if TCP or UDP is selected for Protocol.

    Destination

    Specifies the destination IP address to which the traffic is permitted.

    The default value is 0.0.0.0/0, which indicates that traffic from all IP addresses is permitted.

    For example:

    xxx.xxx.xxx.xxx/32 (IP address)

    xxx.xxx.xxx.0/24 (CIDR block)

    0.0.0.0/0 (any IP address)

    Destination Port Range

    Specifies the destination port number or port number range. The value ranges from 1 to 65535. For a port number range, enter two port numbers connected by a hyphen (-), such as 1-100.

    You must specify this parameter if TCP or UDP is selected for Protocol.

    Description

    Specifies description of the user-defined network ACL rule. This parameter is optional.

    The description can contain a maximum of 255 characters and cannot contain angle brackets (<) or (>).
  4. Click OK.

Associate a User-defined Network ACL with a User-defined Subnet

When you need to associate a user-defined network ACL with a user-defined subnet, go to the user-defined network ACL details page and click the User-defined Subnets tab. By default, a user-defined network ACL denies all inbound traffic to and outbound traffic from the associated subnet until you add rules.

  1. On the BMS console, click the User-defined Networks tab and select User-defined Network ACLs.
  2. Click the name of the target user-defined network ACL.
  3. On the Associate Subnet page, click Associate.
  4. Select the user-defined subnets you want to associate with the user-defined network ACL and click OK.

    User-defined subnets that have already been associated with user-defined network ACLs will not be displayed on the page for you to select. One-click user-defined subnet association and disassociation are not supported. If you want to associate a user-defined subnet that has already been associated with another user-defined network ACL, you must first disassociate the subnet from the original network ACL.

Parent topic: User-defined Network ACL