---
name: containers-vpc-acls
title: Controlling traffic with ACLs
description: With the introduction of Secure by Default networking, it is no longer recommended to change the default network ACLs. Instead, you can manage networking by using VPC security groups.
last-updated: 2025-11-18
---

> ## Documentation Index
> The table of contents for this documentation set is at https://cloud.ibm.com/docs/containers?format=markdown
> The index for all IBM Cloud docs is at: https://cloud.ibm.com/docs/llms.txt
> Use these files to discover more information as needed.

# Controlling traffic with ACLs
{: #vpc-acls}

With the introduction of Secure by Default networking, it is no longer recommended to change the default network ACLs. Instead, you can manage networking by using VPC security groups.
{: important}


For more information about Secure by Default, review the following links.
- [Understanding Secure by Default](https://cloud.ibm.com/docs/containers?topic=containers-vpc-security-group-reference&format=markdown).
- [Managing outbound traffic protection in VPC clusters](https://cloud.ibm.com/docs/containers?topic=containers-sbd-allow-outbound&format=markdown).

If your cluster was created at version 1.29 and earlier, review the following links.
- [Enabling secure by default for clusters created at 1.29 and earlier](https://cloud.ibm.com/docs/containers?topic=containers-vpc-sbd-enable-existing&format=markdown).



## Overview of ACLs
{: #acls-overview}

If you create custom ACLs, only network traffic that is specified in the ACL rules is permitted to and from your VPC subnets. All other traffic that is not specified in the ACLs, such as cluster integrations with third-party services, is blocked for the subnets.
{: important}

Level of application
:   Virtual Private Cloud subnet

Default behavior
:   When you create a VPC, a default ACL is created in the format `allow-all-network-acl-<VPC_ID>` for the VPC. The ACL includes an inbound rule and an outbound rule that allow all traffic to and from your subnets. Any subnet that you create in the VPC is attached to this ACL by default. ACL rules are applied in a particular order. When you allow traffic in one direction by creating an inbound or outbound rule, you must also create a rule for responses in the opposite direction because responses are not automatically permitted.

Use case
:   If you want to specify which traffic is permitted to the worker nodes on your VPC subnets, you can create a custom ACL for each subnet in the VPC. For example, you can create the following set of ACL rules to block most inbound and outbound network traffic of a cluster, while allowing communication that is necessary for the cluster to function.

Required traffic for clusters
:   If you use custom ACLs, you must allow outbound traffic from all subnets to the following endpoints.
:   - [VPC service endpoints](https://cloud.ibm.com/docs/vpc?topic=vpc-service-endpoints-for-vpc&format=markdown)
:   - [VPC IaaS endpoints](https://cloud.ibm.com/docs/vpc?topic=vpc-service-endpoints-for-vpc&format=markdown#infrastructure-as-a-service-iaas-endpoints)
:   - [VPC metadata service IPs](https://cloud.ibm.com/apidocs/vpc-metadata#endpoint-url-metadata)
:   - All subnets in the VPC

Limitations
:   If you create multiple clusters that use the same subnets in one VPC, you can't use ACLs to control traffic between the clusters because they share the same subnets. You can use [Calico network policies](https://cloud.ibm.com/docs/containers?topic=containers-network_policies&format=markdown#isolate_workers) to isolate your clusters on the private network.