*** This version of Confluence is for testing only and contains a copy of content from June 29th 2026. No changes will be preserved. ***
...
A CloudFormation template to create a Network ACL for with the baseline rules can be found here: https://github.com/CU-CommunityApps/cu-aws-cloudformation/tree/master/baseline-nacl
Terraform
A Terraform module to create a Network ACL with these baseline rules can be found here: https://github.com/CU-CommunityApps/tf-module-cornell-util/tree/main/modules/aws/baseline-nacl
Manual Configuration
Inbound Rules
Add an additional ALLOW rule 1600 to allows allow all traffic from source 100.64.0.0/10 if your VPC includes any CIDR blocks in 100.64.0.0/10.
...
Add an additional ALLOW rule 2000 to allows allow all traffic to destination 100.64.0.0/10 if your VPC includes any CIDR blocks in 100.64.0.0/10.
A More Strict Baseline Network ACL
The baseline NACL shown above allows inbound TCP traffic on ports 22 and 3389 from everywhere. This isn't the safest configuration since it doesn't block inbound SSH (22) or RDP (3389) traffic on their default ports. If you wish to block that traffic, we recommend the following alternative set of ingress rules. (Egress rules wouldn't need to change.)
A CloudFormation template to create the strict variant can be found at https://github.com/CU-CommunityApps/cu-aws-cloudformation/blob/main/baseline-nacl/strict-baseline-nacl.yaml
