*** This version of Confluence is for testing only and contains a copy of content from June 29th 2026. No changes will be preserved. ***
...
Add an additional ALLOW rule 2000 to allow all traffic to destination 100.64.0.0/10 if your VPC includes any CIDR blocks in 100.64.0.0/10.
A More Strict Baseline Network ACL
The baseline NACL shown above allows inbound TCP traffic on ports 22 and 3389 from everywhere. This isn't the safest configuration since it doesn't block inbound SSH (22) or RDP (3389) traffic on their default ports. If you wish to block that traffic, we recommend the following alternative set of ingress rules. (Egress rules wouldn't need to change.)
A CloudFormation template to create the strict variant can be found at https://github.com/CU-CommunityApps/cu-aws-cloudformation/blob/main/baseline-nacl/strict-baseline-nacl.yaml
