Only ACL allow rules are supported as part of Network ACLs. Default is to block all incoming and all outgoing traffic between tiers and between tiers and various gateways (including Public).  ACL deny rules will be supported. New field "order" will be added to rules to resolve conflicting rules. After rule creation, its order can be modified.

API:

createNetworkAcl: New parameter "order" will be added. Also have to:

• add "action" parameter (allow/deny) to the API.
• handle the DB upgrade update order number for existing entries
• add API for changing the priority. I would advise to add new API replaceNetworkACL- just the way amazon does. Refer to the document below, "Network ACL" section, last paragraph:

https://cwiki.apache.org/confluence/display/CLOUDSTACK/Amazon+vs+CloudStack+APIs+for+VPC

TBD - add more detailes to this FS draft