---
title: Network ACLs should enforce inbound traffic restrictions
description: Datadog, the leading service for cloud-scale monitoring.
breadcrumbs: >-
  Docs > Datadog Security > OOTB Rules > Network ACLs should enforce inbound
  traffic restrictions
---

> For the complete documentation index, see [llms.txt](https://docs.datadoghq.com/llms.txt).

# Network ACLs should enforce inbound traffic restrictions
 
## Description{% #description %}

Check AWS network access control lists (NACLs) for inbound allow entries that open every port, so that inbound traffic is limited to the port ranges your application needs.

A network ACL fails when an inbound allow entry permits every port. This includes entries for all protocols, TCP or UDP entries with no port range or a range that covers all ports, or entries for protocols other than TCP, UDP, ICMP, or ICMPv6. AWS allows all ports for these protocols regardless of the specified port range. ICMP and ICMPv6 entries have no ports and do not fail this rule. An allow entry does not count when a lower-numbered deny entry in the same direction applies to all protocols, or to the same protocol on every port, for every address (`0.0.0.0/0` or `::/0`) or for the same CIDR, because AWS applies the lowest-numbered matching entry. A network ACL with no entries also fails.

## Rationale{% #rationale %}

Eliminate the threat of unauthorized access malicious activities, such as Denial of Service (DoS) or Distributed Denial of Service (DDoS) attacks, by opening only the ports that are required by your application.

## Remediation{% #remediation %}

Replace each inbound allow entry that opens every port with entries for only the protocols and port ranges your workloads need, following [Add rules to a network ACL](https://docs.aws.amazon.com/vpc/latest/userguide/create-network-acl.html#Rules).