# Ensure default security list restricts all traffic except ICMP within VCN

- Source: https://support.icompaas.com/support/solutions/articles/a_1790698519734852-ensure-default-security-list-restricts-all-traffic-except-icmp-within-vcn
- Section: [Solutions](https://support.icompaas.com/support/solutions) › [Oracle Cloud](https://support.icompaas.com/support/solutions/c_1790697859097233) › [Checks](https://support.icompaas.com/support/solutions/folders/f_1790697878907807)
- Last updated: 2026-09-29
- Publisher: iCompaas, Inc. (https://www.icompaas.com)

**Description**

Ensure the default security list of every VCN does not allow any inbound traffic except ICMP from within the VCN's own CIDR block. Traffic that resources need should be allowed through dedicated security lists or network security groups, rather than through the default list that applies to every new subnet.

**Rationale**

The default security list is automatically attached to subnets that are created without another list, and by default it allows SSH from anywhere. Resources placed in these subnets can then be exposed to the internet without anyone noticing. Restricting the default list to ICMP within the VCN makes new subnets safe by default.

**Impact**

-   New subnets are not exposed by default rules
    
-   Removes the default SSH-from-anywhere rule
    
-   Required traffic must be allowed through dedicated rules
    

**Default Value**

By default, the default security list allows TCP port 22 from 0.0.0.0/0, ICMP type 3 code 4 from 0.0.0.0/0, and ICMP type 3 from the VCN CIDR, and allows all egress traffic.

**Pre-Requisites**

-   Permission to manage virtual-network-family in the compartment
    
-   Dedicated security lists or network security groups for traffic that resources need
    

**Test Plan**

1.  Sign in to the OCI Console at [https://cloud.oracle.com](https://cloud.oracle.com/).
    
2.  Open the navigation menu, select Networking, and select Virtual cloud networks. Choose the compartment and select the VCN.
    
3.  Open the Security tab and select the security list named Default Security List for <VCN name>.
    
4.  Review the ingress rules and verify that the only rules allow ICMP from the VCN's CIDR block.
    
5.  If any other ingress rule exists, follow the implementation steps.
    

**Implementation Steps**

1.  Sign in to the OCI Console at [https://cloud.oracle.com](https://cloud.oracle.com/).
    
2.  Open the navigation menu, select Networking, and select Virtual cloud networks. Choose the compartment and select the VCN.
    
3.  Create a dedicated security list or network security group for any traffic your resources need, and attach it to the subnets or VNICs.
    
4.  Open the default security list for the VCN.
    
5.  Delete every ingress rule except ICMP from the VCN CIDR block, and save.
    
6.  Confirm that applications still work through the dedicated rules.
    

**Backout Plan**

1.  Sign in to the OCI Console at [https://cloud.oracle.com](https://cloud.oracle.com/).
    
2.  Open the navigation menu, select Networking, and select Virtual cloud networks. Choose the compartment and select the VCN.
    
3.  Open the default security list and add back the removed ingress rules, then save.
    

**Reference**

-   [https://docs.oracle.com/en-us/iaas/Content/Network/Concepts/securitylists.htm](https://docs.oracle.com/en-us/iaas/Content/Network/Concepts/securitylists.htm)

## Related compliance guidance

- [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): Configuration checks like this one are the technical half of a SOC 2 / ISO 27001 programme — the guide shows where they fit, what else an auditor expects, and how to evidence them.
- [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): ISO 27001 Annex A.8 (technological controls) is where cloud hardening evidence lands; the guide shows how to run the ISMS around it.