- 动态与公告
- 腾讯云网络总览
- 产品简介
- 购买指南
- 快速入门
- 操作指南
- 实践教程
- 故障处理
- API 文档
- History
- Introduction
- API Category
- Making API Requests
- VPC APIs
- CreateAssistantCidr
- DeleteAssistantCidr
- DeleteTrafficPackages
- DescribeClassicLinkInstances
- DescribeTrafficPackages
- ModifyAssistantCidr
- AssignIpv6CidrBlock
- CreateDefaultVpc
- CreateLocalGateway
- DeleteLocalGateway
- DescribeAccountAttributes
- DescribeAssistantCidr
- DescribeLocalGateway
- DescribeUsedIpAddress
- DescribeVpcInstances
- DescribeVpcIpv6Addresses
- DescribeVpcPrivateIpAddresses
- ModifyLocalGateway
- UnassignIpv6CidrBlock
- AttachClassicLinkVpc
- CheckAssistantCidr
- DeleteVpc
- DescribeVpcResourceDashboard
- DetachClassicLinkVpc
- CreateVpc
- DescribeVpcs
- AdjustPublicAddress
- ModifyVpcAttribute
- ModifyReserveIpAddress
- DescribeReserveIpAddresses
- DeleteReserveIpAddresses
- CreateReserveIpAddresses
- Route Table APIs
- EIP APIs
- Highly Available Virtual IP APIs
- ENI APIs
- AssignIpv6Addresses
- AssignPrivateIpAddresses
- AssociateNetworkInterfaceSecurityGroups
- CreateAndAttachNetworkInterface
- CreateNetworkInterface
- DescribeNetworkInterfaceLimit
- DisassociateNetworkInterfaceSecurityGroups
- ModifyIpv6AddressesAttribute
- ModifyNetworkInterfaceAttribute
- UnassignIpv6Addresses
- DeleteNetworkInterface
- DescribeNetworkInterfaces
- DetachNetworkInterface
- MigrateNetworkInterface
- MigratePrivateIpAddress
- ModifyPrivateIpAddressesAttribute
- UnassignPrivateIpAddresses
- AttachNetworkInterface
- Bandwidth Package APIs
- NAT Gateway APIs
- CreateNatGatewayDestinationIpPortTranslationNatRule
- CreateNatGatewaySourceIpTranslationNatRule
- DeleteNatGateway
- DeleteNatGatewayDestinationIpPortTranslationNatRule
- DeleteNatGatewaySourceIpTranslationNatRule
- DescribeNatGatewayDestinationIpPortTranslationNatRules
- DescribeNatGatewayDirectConnectGatewayRoute
- DescribeNatGatewaySourceIpTranslationNatRules
- DescribeNatGateways
- DisassociateNatGatewayAddress
- ModifyNatGatewayDestinationIpPortTranslationNatRule
- ModifyNatGatewaySourceIpTranslationNatRule
- RefreshDirectConnectGatewayRouteToNatGateway
- ResetNatGatewayConnection
- AssociateNatGatewayAddress
- CreateNatGateway
- ModifyNatGatewayAttribute
- Direct Connect Gateway APIs
- CreateDirectConnectGateway
- CreateDirectConnectGatewayCcnRoutes
- DeleteDirectConnectGateway
- DeleteDirectConnectGatewayCcnRoutes
- DescribeDirectConnectGatewayCcnRoutes
- DescribeDirectConnectGateways
- InquirePriceCreateDirectConnectGateway
- ModifyDirectConnectGatewayAttribute
- ReplaceDirectConnectGatewayCcnRoutes
- AssociateDirectConnectGatewayNatGateway
- DisassociateDirectConnectGatewayNatGateway
- Cloud Connect Network APIs
- AcceptAttachCcnInstances
- DescribeCrossBorderCompliance
- DetachCcnInstances
- EnableCcnRoutes
- ModifyCcnAttachedInstancesAttribute
- ModifyCcnAttribute
- RejectAttachCcnInstances
- ResetAttachCcnInstances
- CreateCcn
- DeleteCcn
- DisableCcnRoutes
- SetCcnRegionBandwidthLimits
- AttachCcnInstances
- DescribeCcnRegionBandwidthLimits
- AuditCrossBorderCompliance
- DescribeCcnAttachedInstances
- DescribeCcnRoutes
- DescribeCcns
- GetCcnRegionBandwidthLimits
- ModifyCcnRegionBandwidthLimitsType
- Network ACL APIs
- Network Detection-Related APIs
- Flow Log APIs
- Gateway Traffic Monitor APIs
- Private Link APIs
- CreateVpcEndPoint
- CreateVpcEndPointService
- CreateVpcEndPointServiceWhiteList
- DeleteVpcEndPoint
- DeleteVpcEndPointService
- DeleteVpcEndPointServiceWhiteList
- DescribeVpcEndPointServiceWhiteList
- DisassociateVpcEndPointSecurityGroups
- ModifyVpcEndPointAttribute
- ModifyVpcEndPointServiceWhiteList
- ModifyVpcEndPointServiceAttribute
- DescribeVpcEndPoint
- EnableVpcEndPointConnect
- DescribeVpcEndPointService
- Other APIs
- Subnet APIs
- VPN Gateway APIs
- RenewVpnGateway
- ModifyVpnGatewayRoutes
- CreateVpnGatewayRoutes
- DeleteVpnGatewayRoutes
- DescribeCustomerGateways
- DescribeVpnConnections
- DescribeVpnGatewayCcnRoutes
- DescribeVpnGatewayRoutes
- DownloadCustomerGatewayConfiguration
- ModifyVpnGatewayCcnRoutes
- SetVpnGatewaysRenewFlag
- CreateCustomerGateway
- CreateVpnConnection
- CreateVpnGateway
- DeleteCustomerGateway
- DeleteVpnConnection
- DeleteVpnGateway
- DescribeCustomerGatewayVendors
- DescribeVpnGateways
- GenerateVpnConnectionDefaultHealthCheckIp
- InquiryPriceRenewVpnGateway
- InquiryPriceResetVpnGatewayInternetMaxBandwidth
- ModifyCustomerGatewayAttribute
- ModifyVpnConnectionAttribute
- ModifyVpnGatewayAttribute
- ResetVpnConnection
- ResetVpnGatewayInternetMaxBandwidth
- InquiryPriceCreateVpnGateway
- Security Group APIs
- DescribeSecurityGroupReferences
- CloneSecurityGroup
- DeleteSecurityGroup
- DeleteSecurityGroupPolicies
- DescribeSecurityGroupAssociationStatistics
- DescribeSecurityGroupPolicies
- DescribeSecurityGroups
- ModifySecurityGroupAttribute
- ModifySecurityGroupPolicies
- ReplaceSecurityGroupPolicies
- ReplaceSecurityGroupPolicy
- CreateSecurityGroupPolicies
- CreateSecurityGroupWithPolicies
- CreateSecurityGroup
- Network Parameter Template-Related APIs
- CreateAddressTemplate
- CreateAddressTemplateGroup
- DeleteAddressTemplate
- DeleteAddressTemplateGroup
- DeleteServiceTemplate
- DeleteServiceTemplateGroup
- DescribeAddressTemplateGroups
- DescribeAddressTemplates
- DescribeServiceTemplateGroups
- DescribeServiceTemplates
- ModifyAddressTemplateAttribute
- ModifyAddressTemplateGroupAttribute
- ModifyServiceTemplateGroupAttribute
- CreateServiceTemplate
- CreateServiceTemplateGroup
- ModifyServiceTemplateAttribute
- Snapshot Policy APIs
- Error Codes
- Data Types
- 常见问题
- 联系我们
- 词汇表
- 动态与公告
- 腾讯云网络总览
- 产品简介
- 购买指南
- 快速入门
- 操作指南
- 实践教程
- 故障处理
- API 文档
- History
- Introduction
- API Category
- Making API Requests
- VPC APIs
- CreateAssistantCidr
- DeleteAssistantCidr
- DeleteTrafficPackages
- DescribeClassicLinkInstances
- DescribeTrafficPackages
- ModifyAssistantCidr
- AssignIpv6CidrBlock
- CreateDefaultVpc
- CreateLocalGateway
- DeleteLocalGateway
- DescribeAccountAttributes
- DescribeAssistantCidr
- DescribeLocalGateway
- DescribeUsedIpAddress
- DescribeVpcInstances
- DescribeVpcIpv6Addresses
- DescribeVpcPrivateIpAddresses
- ModifyLocalGateway
- UnassignIpv6CidrBlock
- AttachClassicLinkVpc
- CheckAssistantCidr
- DeleteVpc
- DescribeVpcResourceDashboard
- DetachClassicLinkVpc
- CreateVpc
- DescribeVpcs
- AdjustPublicAddress
- ModifyVpcAttribute
- ModifyReserveIpAddress
- DescribeReserveIpAddresses
- DeleteReserveIpAddresses
- CreateReserveIpAddresses
- Route Table APIs
- EIP APIs
- Highly Available Virtual IP APIs
- ENI APIs
- AssignIpv6Addresses
- AssignPrivateIpAddresses
- AssociateNetworkInterfaceSecurityGroups
- CreateAndAttachNetworkInterface
- CreateNetworkInterface
- DescribeNetworkInterfaceLimit
- DisassociateNetworkInterfaceSecurityGroups
- ModifyIpv6AddressesAttribute
- ModifyNetworkInterfaceAttribute
- UnassignIpv6Addresses
- DeleteNetworkInterface
- DescribeNetworkInterfaces
- DetachNetworkInterface
- MigrateNetworkInterface
- MigratePrivateIpAddress
- ModifyPrivateIpAddressesAttribute
- UnassignPrivateIpAddresses
- AttachNetworkInterface
- Bandwidth Package APIs
- NAT Gateway APIs
- CreateNatGatewayDestinationIpPortTranslationNatRule
- CreateNatGatewaySourceIpTranslationNatRule
- DeleteNatGateway
- DeleteNatGatewayDestinationIpPortTranslationNatRule
- DeleteNatGatewaySourceIpTranslationNatRule
- DescribeNatGatewayDestinationIpPortTranslationNatRules
- DescribeNatGatewayDirectConnectGatewayRoute
- DescribeNatGatewaySourceIpTranslationNatRules
- DescribeNatGateways
- DisassociateNatGatewayAddress
- ModifyNatGatewayDestinationIpPortTranslationNatRule
- ModifyNatGatewaySourceIpTranslationNatRule
- RefreshDirectConnectGatewayRouteToNatGateway
- ResetNatGatewayConnection
- AssociateNatGatewayAddress
- CreateNatGateway
- ModifyNatGatewayAttribute
- Direct Connect Gateway APIs
- CreateDirectConnectGateway
- CreateDirectConnectGatewayCcnRoutes
- DeleteDirectConnectGateway
- DeleteDirectConnectGatewayCcnRoutes
- DescribeDirectConnectGatewayCcnRoutes
- DescribeDirectConnectGateways
- InquirePriceCreateDirectConnectGateway
- ModifyDirectConnectGatewayAttribute
- ReplaceDirectConnectGatewayCcnRoutes
- AssociateDirectConnectGatewayNatGateway
- DisassociateDirectConnectGatewayNatGateway
- Cloud Connect Network APIs
- AcceptAttachCcnInstances
- DescribeCrossBorderCompliance
- DetachCcnInstances
- EnableCcnRoutes
- ModifyCcnAttachedInstancesAttribute
- ModifyCcnAttribute
- RejectAttachCcnInstances
- ResetAttachCcnInstances
- CreateCcn
- DeleteCcn
- DisableCcnRoutes
- SetCcnRegionBandwidthLimits
- AttachCcnInstances
- DescribeCcnRegionBandwidthLimits
- AuditCrossBorderCompliance
- DescribeCcnAttachedInstances
- DescribeCcnRoutes
- DescribeCcns
- GetCcnRegionBandwidthLimits
- ModifyCcnRegionBandwidthLimitsType
- Network ACL APIs
- Network Detection-Related APIs
- Flow Log APIs
- Gateway Traffic Monitor APIs
- Private Link APIs
- CreateVpcEndPoint
- CreateVpcEndPointService
- CreateVpcEndPointServiceWhiteList
- DeleteVpcEndPoint
- DeleteVpcEndPointService
- DeleteVpcEndPointServiceWhiteList
- DescribeVpcEndPointServiceWhiteList
- DisassociateVpcEndPointSecurityGroups
- ModifyVpcEndPointAttribute
- ModifyVpcEndPointServiceWhiteList
- ModifyVpcEndPointServiceAttribute
- DescribeVpcEndPoint
- EnableVpcEndPointConnect
- DescribeVpcEndPointService
- Other APIs
- Subnet APIs
- VPN Gateway APIs
- RenewVpnGateway
- ModifyVpnGatewayRoutes
- CreateVpnGatewayRoutes
- DeleteVpnGatewayRoutes
- DescribeCustomerGateways
- DescribeVpnConnections
- DescribeVpnGatewayCcnRoutes
- DescribeVpnGatewayRoutes
- DownloadCustomerGatewayConfiguration
- ModifyVpnGatewayCcnRoutes
- SetVpnGatewaysRenewFlag
- CreateCustomerGateway
- CreateVpnConnection
- CreateVpnGateway
- DeleteCustomerGateway
- DeleteVpnConnection
- DeleteVpnGateway
- DescribeCustomerGatewayVendors
- DescribeVpnGateways
- GenerateVpnConnectionDefaultHealthCheckIp
- InquiryPriceRenewVpnGateway
- InquiryPriceResetVpnGatewayInternetMaxBandwidth
- ModifyCustomerGatewayAttribute
- ModifyVpnConnectionAttribute
- ModifyVpnGatewayAttribute
- ResetVpnConnection
- ResetVpnGatewayInternetMaxBandwidth
- InquiryPriceCreateVpnGateway
- Security Group APIs
- DescribeSecurityGroupReferences
- CloneSecurityGroup
- DeleteSecurityGroup
- DeleteSecurityGroupPolicies
- DescribeSecurityGroupAssociationStatistics
- DescribeSecurityGroupPolicies
- DescribeSecurityGroups
- ModifySecurityGroupAttribute
- ModifySecurityGroupPolicies
- ReplaceSecurityGroupPolicies
- ReplaceSecurityGroupPolicy
- CreateSecurityGroupPolicies
- CreateSecurityGroupWithPolicies
- CreateSecurityGroup
- Network Parameter Template-Related APIs
- CreateAddressTemplate
- CreateAddressTemplateGroup
- DeleteAddressTemplate
- DeleteAddressTemplateGroup
- DeleteServiceTemplate
- DeleteServiceTemplateGroup
- DescribeAddressTemplateGroups
- DescribeAddressTemplates
- DescribeServiceTemplateGroups
- DescribeServiceTemplates
- ModifyAddressTemplateAttribute
- ModifyAddressTemplateGroupAttribute
- ModifyServiceTemplateGroupAttribute
- CreateServiceTemplate
- CreateServiceTemplateGroup
- ModifyServiceTemplateAttribute
- Snapshot Policy APIs
- Error Codes
- Data Types
- 常见问题
- 联系我们
- 词汇表
网络访问控制列表（Access Control List，ACL）是一种子网级别的可选安全层，用于控制进出子网的数据流，可以精确到协议和端口粒度。
使用场景
您可以为具有相同网络流量控制的子网关联同一个网络 ACL，通过设置出站和入站规则，对进出子网的流量进行精确控制。
例如，您在腾讯云私有网络内托管多层 Web 应用，创建了不同子网分别部署 Web 层、逻辑层和数据层服务，通过网络 ACL，您可以控制这三个子网之间的访问，使得：Web 层子网和数据层子网无法相互访问，只有逻辑层可以访问 Web 层和数据层子网。
ACL 规则
当您在网络 ACL 中添加或删除规则后，会自动应用到与其相关联的子网的网络流量控制。
网络 ACL 规则包含入站规则和出站规则，规则组成如下：
源 IP/目标 IP：流量的源/目标 IP。如果是入站规则，需要输入源 IP；如果是出站规则，需要输入目标 IP，源/目标 IP 均支持以下格式：
单个 IP：例如 192.168.0.1 或 FF05::B5
CIDR：例如 192.168.1.0/24 或 FF05:B5::/60
所有 IPv4：0.0.0.0/0
协议类型：选择 ACL 规则允许/拒绝的协议类型，例如 TCP、UDP 等。
端口：流量的来源/目标端口，端口支持以下格式：
单个端口：例如 22 或 80
连续端口：例如 1-65535 或 100-20000
所有端口：ALL
策略：允许或拒绝。
默认规则
每个网络 ACL 在创建后都将包含两条默认规则，默认规则无法修改或删除，且优先级最低。
入方向默认规则
协议类型 | 端口 | 源 IP | 策略 | 说明 |
ALL | ALL | 0.0.0.0/0 | 拒绝 | 拒绝所有入站流量 |
出方向默认规则
协议类型 | 端口 | 目标 IP | 策略 | 说明 |
ALL | ALL | 0.0.0.0/0 | 拒绝 | 拒绝所有出站流量 |
规则优先级
网络 ACL 规则的优先级通过规则在列表中的位置来表示，列表顶端的规则优先级最高，最先应用；列表底端的规则优先级最低。
若有规则冲突，则默认应用位置更前的规则。
当绑定了网络 ACL 的子网有流量入/出时，将从网络 ACL 列表顶端的规则开始逐条匹配至最后一条。如果匹配某一条规则成功，则允许通过，不再匹配该规则之后的规则。
应用示例
假设某子网关联了网络 ACL，该子网允许所有源 IP 访问子网内云服务器的所有端口，同时拒绝源 IP 为192.168.200.11/24的 HTTP 服务访问80端口。根据上述要求，其关联的网络 ACL 应添加如下两条入站规则：
协议类型 | 端口 | 源 IP | 策略 | 说明 |
HTTP | 80 | 192.168.200.11/24 | 拒绝 | 拒绝该 IP 的 HTTP 服务访问80端口 |
ALL | ALL | 0.0.0.0/0 | 允许 | 允许所有源 IP 访问所有端口 |
安全组与网络 ACL 的区别
对比项 | 安全组 | 网络 ACL |
流量控制 | 云服务器、数据库等实例级别的流量访问控制 | 子网级别的流量控制 |
规则 | 支持允许规则、拒绝规则 | 支持允许规则、拒绝规则 |
有无状态 | 有状态：返回数据流会被自动允许，不受任何规则的影响 | 无状态：返回数据流必须被规则明确允许 |
生效时间 | 只有在创建云服务器、云数据库等实例时指定安全组，或实例创建后再关联安全组，规则才会被应用到实例 | 创建 ACL 并绑定子网后，ACL 将自动应用到关联子网内的所有云服务器、云数据库等实例 |
规则优先级 | 有规则冲突时，默认应用位置更前的规则 | 有规则冲突时，默认应用位置更前的规则 |
是
否
本页内容是否解决了您的问题？