...
A network ACL applies to a subnet as a whole. Only one network ACL per subnet is allowed. The rules in a network ACL are stateless (i.e., return traffic must be explicitly allowed). Rules can be defined for inbound or outbound traffic, they can allow or deny traffic, and they are evaluated starting from the lowest rule number. After the first match the search is terminated. The default network ACL allows all inbound and outbound IP traffic.
...