---
title: Network ACLs should enforce outbound traffic restrictions
description: Datadog, the leading service for cloud-scale monitoring.
breadcrumbs: >-
  Docs > Datadog Security > OOTB Rules > Network ACLs should enforce outbound
  traffic restrictions
---

> For the complete documentation index, see [llms.txt](https://docs.datadoghq.com/llms.txt).

# Network ACLs should enforce outbound traffic restrictions
 
## Description{% #description %}

Check AWS network access control lists (NACLs) for outbound allow entries that open every port, so that outbound traffic is limited to the port ranges your application needs.

A network ACL fails when an outbound allow entry permits every port. This includes an entry for all protocols, TCP or UDP entries with no port ranges or ranges that cover all ports, or entries for protocols other than TCP, UDP, ICMP, or ICMPv6. AWS allows all ports for these protocols regardless of any port range. ICMP and ICMPv6 entries have no ports and do not fail this rule. An allow entry does not count when a lower-numbered deny entry in the same direction applies to all protocols, or to the same protocol on every port, for every address (`0.0.0.0/0` or `::/0`) or for the same CIDR, because AWS applies the lowest-numbered matching entry. A network ACL with no entries also fails.

## Rationale{% #rationale %}

Eliminate the threat of unauthorized access by setting a specified port range.

## Remediation{% #remediation %}

Replace each outbound allow entry that opens every port with entries for only the protocols and port ranges your workloads need, following [Add rules to a network ACL](https://docs.aws.amazon.com/vpc/latest/userguide/create-network-acl.html#Rules).