# Ensure no Network ACLs allow ingress from 0.0.0.0/0 to any port

- Source: https://support.icompaas.com/support/solutions/articles/62000223400-ensure-no-network-acls-allow-ingress-from-0-0-0-0-0-to-any-port
- Section: [Solutions](https://support.icompaas.com/support/solutions) › [Security Controls](https://support.icompaas.com/support/solutions/62000065178) › [VPC Policies](https://support.icompaas.com/support/solutions/folders/62000097631)
- Last updated: 2026-05-29
- Publisher: iCompaas, Inc. (https://www.icompaas.com)

### **Description:**

A network access control list (ACL) is an optional layer of security for your VPC that acts as a firewall for controlling traffic in and out of one or more subnets. You might set up network ACLs with rules similar to your security groups in order to add an additional layer of security to your VPC.

#### **Rational:**

You can create a Network ACL’s and add rules that reflect the role of the instance that's associated with the Network ACL’s. For example, an instance that's configured as a web server needs Network ACL’s rules that allow inbound HTTP and HTTPS access. Likewise, a database instance needs rules that allow access for the type of database, such as access over port 3306 for MySQL.

#### **Impact:**

If you won’t setup the Network ACL’s their might be chance of attacks 

#### **Default Value:**

VPC automatically comes with a default Network ACLs. If you don't specify a different Network ACLs when you launch the instance, the default Network ACLs will be associated with the instance. By default the Network ACLs deny’s all inbound connections.

  

### **Pre-Requisite:**

1.   Before start the below implementation steps write all configuration which IP and which port in the inbound.
    
2.  Avoid the login through the Root user.
    
3.   You cannot delete the default **network ACLs**,  but you can edit and modify them here so you can create security groups and create your own rules in them.
    

### **Remediation:**

#### **Test Plan:**

1.  Sign in to the AWS Management Console
    
2.  Go to VPC console at [https://console.aws.amazon.com/vpc/](https://console.aws.amazon.com/vpc/ "https://console.aws.amazon.com/vpc/")
    
3.  In the navigation pane, choose **Network ACLs** under Security section ![](https://support.icompaas.com/assets/kb/cd8136d12861432d.png) 
    
4.  Select the Network ACLs you want to modify and click on **Inbound Rules** Tab![](https://support.icompaas.com/assets/kb/0531761b44a9496f.png)
    
5.  If you find All traffic is allowed from source 0.0.0.0/0
    
6.  Then follow the remediation steps
    

  

**Using AWS CLI:**

aws ec2 describe-network-acls

  
**Implementation Steps**:

1.  Sign in to the AWS Management Console
    
2.  Go to VPC console at [https://console.aws.amazon.com/vpc/](https://console.aws.amazon.com/vpc/ "https://console.aws.amazon.com/vpc/")
    
3.  In the navigation pane, choose **Network ACL****s** under Security section
    
      
    
4.  Select the Network ACLs you want to modify and click on **Inbound Rules** Tab![](https://support.icompaas.com/assets/kb/b4dc221d3cc7cf27.png)
    
5.  Select the rule and click **Edit Inbound Rules** which is on the right side![](https://support.icompaas.com/assets/kb/1d806a25fe3bd69a.png)
    
6.  Select the **protocols**, enter **source** to which the protocol should be allowed and select **allow**,![](https://support.icompaas.com/assets/kb/156bc427f2194682.png)
    
      
    
7.  Once its done, click on **Save rules.**
    

  

**Using AWS CLI:**

aws ec2 replace-network-acl-entry --network-acl-id acl-5fb85d36 --ingress --rule-number 100 --protocol udp --port-range From=53,To=53 --cidr-block 203.0.113.12/24 --rule-action allow

  
**Backout Plan:**

If you want to proceed with previous settings go through the Implementation steps section and set all previous policies. You can delete your new Network ACLs by following the steps:

1.  Open the Amazon VPC console [https://console.aws.amazon.com/vpc/](https://console.aws.amazon.com/vpc/ "https://console.aws.amazon.com/vpc/")
    
2.  In the navigation pane, choose **Network ACLs**
    
3.  Select one or more Network ACLs and choose **Network ACLs Actions, Delete Network ACLs.**
    
4.  In the **Delete Network ACLs** dialogue box, choose **Yes, Delete**
    

  

**Using AWS CLI:**

aws ec2 delete-network-acl --network-acl-id acl-5fb85

**Reference:**

1.  [![](https://support.icompaas.com/assets/kb/16f570040a1e6f65.png)Control traffic to subnets using Network ACLs - Amazon Virtual Private Cloud](https://docs.aws.amazon.com/vpc/latest/userguide/vpc-network-acls.html) 
    
2.  [![](https://support.icompaas.com/assets/kb/4d097aab17be3cc4.png)delete-network-acl — AWS CLI 1.22.80 Command Reference](https://docs.aws.amazon.com/cli/latest/reference/ec2/delete-network-acl.html)

## Related compliance guidance

- [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): Configuration checks like this one are the technical half of a SOC 2 / ISO 27001 programme — the guide shows where they fit, what else an auditor expects, and how to evidence them.
- [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): ISO 27001 Annex A.8 (technological controls) is where cloud hardening evidence lands; the guide shows how to run the ISMS around it.