Network ACLs
Filter network traffic with ingress and egress rules and attach ACLs to bridge and OVN networks.
Network ACLs (access control lists) filter traffic entering and leaving your networks. An ACL is a named set of ingress and egress rules that you attach to one or more networks; you can also log matched traffic and download the logs per ACL.
Create an ACL
- Go to Networking → ACLs and click the create action.
- Enter a name and an optional description.
- Add rules to the Ingress table (traffic coming into the network) and the Egress table (traffic leaving it).
- Save the ACL.
A YAML tab shows the full ACL definition. On the ACL detail page you can rename the ACL by clicking its name in the header, edit its rules, or delete it.
Rule fields
Each ingress or egress rule has the following fields:
| Field | Values | Notes |
|---|---|---|
| Action | allow, reject, drop | reject answers the sender with an error; drop discards traffic silently. |
| State | enabled, disabled, logged | logged applies the rule and records matches in the ACL's log. |
| Protocol | any, icmp4, icmp6, tcp, udp | |
| Source | CIDR, IP ranges, or empty | Empty matches any source. For ingress rules, the source can also be a subject name selector. |
| Destination | CIDR, IP ranges, or empty | Empty matches any destination. |
| Source port / Destination port | Port numbers or ranges | Only for tcp and udp rules. |
| Description | Free text | Optional. |
Attach an ACL to a network
ACLs take effect when attached to a network. Bridge and OVN networks support ACLs: set the security.acls field in the network's configuration form to the ACLs you want to apply. See Manage networks.
Log traffic
To see which traffic a rule matches, set the rule's state to logged. Then use the Download logs action on the ACL to retrieve its log entries. Logging is useful for verifying that a rule matches the traffic you expect — but note that a logged rule is enforced exactly like an enabled one; the only difference is that matches are recorded. Once you have confirmed the rule behaves as intended, switch it to enabled to stop logging.