{ "api_version": "1", "kind": "dse_post", "self": "https://update.dsesecurity.com/api/v1/posts/dse-20260908-217-interpret-hyper-v-extended-acl-direction-from-the-vm-perspective/", "item": { "id": "https://update.dsesecurity.com/updates/dse-20260908-217-interpret-hyper-v-extended-acl-direction-from-the-vm-perspective/", "slug": "dse-20260908-217-interpret-hyper-v-extended-acl-direction-from-the-vm-perspective", "url": "https://update.dsesecurity.com/updates/dse-20260908-217-interpret-hyper-v-extended-acl-direction-from-the-vm-perspective/", "alternate_urls": { "markdown": "https://update.dsesecurity.com/updates/dse-20260908-217-interpret-hyper-v-extended-acl-direction-from-the-vm-perspective.md", "json": "https://update.dsesecurity.com/api/v1/posts/dse-20260908-217-interpret-hyper-v-extended-acl-direction-from-the-vm-perspective/" }, "title": "Interpret Hyper-V extended ACL direction from the VM perspective", "summary": "How should an extended virtual-switch ACL define traffic direction and scope?", "format": { "slug": "guide", "name": "Guide" }, "priority": { "slug": "info", "name": "Information" }, "featured": false, "image": { "theme": "continuity-recovery", "label": "Continuity & recovery", "alt": "Paired infrastructure paths converging on a stable recovered service.", "card_url": "https://update.dsesecurity.com/assets/editorial/continuity-recovery-card.webp?v=1.8.20", "hero_url": "https://update.dsesecurity.com/assets/editorial/continuity-recovery-hero.webp?v=1.8.20", "social_url": "https://update.dsesecurity.com/assets/editorial/continuity-recovery-social-v2.jpg?v=1.8.20", "width": 2400, "height": 1350 }, "topics": [ { "slug": "business-continuity", "name": "Business Continuity", "url": "https://update.dsesecurity.com/topic/business-continuity/" }, { "slug": "it", "name": "IT", "url": "https://update.dsesecurity.com/topic/it/" } ], "author": { "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team", "type": "Organization" }, "publisher": { "name": "Detection Systems & Engineering", "url": "https://dsesecurity.com/" }, "published_at": "2026-09-08T18:13:34+00:00", "modified_at": "2026-09-08T18:29:33+00:00", "reviewed_on": "2026-09-08", "reading_minutes": 2, "word_count": 221, "potentially_affected": "Administrators configuring extended port ACLs on Hyper-V VM network adapters.", "dse_recommendation": "Write the intended allowed and denied flows in a small matrix and have a second reviewer translate each into the documented direction convention.", "primary_source": { "name": "Create Security Policies with Extended Port Access Control Lists", "url": "https://learn.microsoft.com/en-us/windows-server/virtualization/hyper-v/create-security-policies-extended-port-access-control-lists", "published_on": null, "authority": "Microsoft Learn" }, "publishing_principles": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usage_info": "https://update.dsesecurity.com/usage/", "copyright_notice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "content_html": "

Source facts

\n

Microsoft documents extended ACLs applied to individual VM network adapters on a Hyper-V virtual switch. The rules can match source and destination addresses, protocol, and source and destination ports. In the documented direction convention, inbound means traffic received by the VM and outbound means traffic sent from it. Microsoft Learn.

\n

Applicability

\n

Identify the precise VM adapter and application flow before writing a rule. Review source, destination, protocol, and both port roles from that VM’s perspective. Keep an ACL on the virtual adapter distinct from a host firewall rule or a physical-network filter.

\n

DSE recommendation

\n

Write the intended allowed and denied flows in a small matrix and have a second reviewer translate each into the documented direction convention. Preserve the existing adapter ACLs and name the rollback owner. Pilot one application path, including the reply traffic and a deliberately prohibited source. Avoid broadening a rule simply because its first test was written in the wrong direction.

\n

Verification

\n

Generate the approved test flows from both sides of the VM boundary and record the effective rule and result. Confirm an excluded flow remains blocked while the required transaction works. Recheck the exact adapter association after configuration and document any other filter that affected the observed outcome.

\n

Official references

\n

Microsoft Learn: Create Security Policies with Extended Port Access Control Lists. Source reviewed September 8, 2026.

", "content_text": "Source facts\nMicrosoft documents extended ACLs applied to individual VM network adapters on a Hyper-V virtual switch. The rules can match source and destination addresses, protocol, and source and destination ports. In the documented direction convention, inbound means traffic received by the VM and outbound means traffic sent from it. Microsoft Learn.\nApplicability\nIdentify the precise VM adapter and application flow before writing a rule. Review source, destination, protocol, and both port roles from that VM’s perspective. Keep an ACL on the virtual adapter distinct from a host firewall rule or a physical-network filter.\nDSE recommendation\nWrite the intended allowed and denied flows in a small matrix and have a second reviewer translate each into the documented direction convention. Preserve the existing adapter ACLs and name the rollback owner. Pilot one application path, including the reply traffic and a deliberately prohibited source. Avoid broadening a rule simply because its first test was written in the wrong direction.\nVerification\nGenerate the approved test flows from both sides of the VM boundary and record the effective rule and result. Confirm an excluded flow remains blocked while the required transaction works. Recheck the exact adapter association after configuration and document any other filter that affected the observed outcome.\nOfficial references\nMicrosoft Learn: Create Security Policies with Extended Port Access Control Lists. Source reviewed September 8, 2026.", "content_markdown": "## Source facts\n\nMicrosoft documents extended ACLs applied to individual VM network adapters on a Hyper-V virtual switch. The rules can match source and destination addresses, protocol, and source and destination ports. In the documented direction convention, inbound means traffic received by the VM and outbound means traffic sent from it. [Microsoft Learn](https://learn.microsoft.com/en-us/windows-server/virtualization/hyper-v/create-security-policies-extended-port-access-control-lists).\n\n## Applicability\n\nIdentify the precise VM adapter and application flow before writing a rule. Review source, destination, protocol, and both port roles from that VM’s perspective. Keep an ACL on the virtual adapter distinct from a host firewall rule or a physical-network filter.\n\n## DSE recommendation\n\nWrite the intended allowed and denied flows in a small matrix and have a second reviewer translate each into the documented direction convention. Preserve the existing adapter ACLs and name the rollback owner. Pilot one application path, including the reply traffic and a deliberately prohibited source. Avoid broadening a rule simply because its first test was written in the wrong direction.\n\n## Verification\n\nGenerate the approved test flows from both sides of the VM boundary and record the effective rule and result. Confirm an excluded flow remains blocked while the required transaction works. Recheck the exact adapter association after configuration and document any other filter that affected the observed outcome.\n\n## Official references\n\n[Microsoft Learn: Create Security Policies with Extended Port Access Control Lists](https://learn.microsoft.com/en-us/windows-server/virtualization/hyper-v/create-security-policies-extended-port-access-control-lists). Source reviewed September 8, 2026." }, "json_ld": { "@context": "https://schema.org", "@graph": [ { "@type": "Organization", "@id": "https://dsesecurity.com/#organization", "name": "Detection Systems & Engineering", "alternateName": "DSE Security", "url": "https://dsesecurity.com/", "logo": { "@type": "ImageObject", "url": "https://update.dsesecurity.com/assets/dse-logo-20260812.png?v=1.8.20" } }, { "@type": "Organization", "@id": "https://update.dsesecurity.com/#editorial-team", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/", "parentOrganization": { "@id": "https://dsesecurity.com/#organization" } }, { "@type": "WebSite", "@id": "https://update.dsesecurity.com/#website", "name": "DSE Updates", "alternateName": "DSE Security Knowledge Hub", "url": "https://update.dsesecurity.com/", "inLanguage": "en-US", "publisher": { "@id": "https://dsesecurity.com/#organization" }, "potentialAction": { "@type": "SearchAction", "target": { "@type": "EntryPoint", "urlTemplate": "https://update.dsesecurity.com/?q={search_term_string}" }, "query-input": "required name=search_term_string" } }, { "@type": "WebPage", "@id": "https://update.dsesecurity.com/updates/dse-20260908-217-interpret-hyper-v-extended-acl-direction-from-the-vm-perspective/", "url": "https://update.dsesecurity.com/updates/dse-20260908-217-interpret-hyper-v-extended-acl-direction-from-the-vm-perspective/", "isPartOf": { "@id": "https://update.dsesecurity.com/#website" }, "lastReviewed": "2026-09-08" }, { "@type": "BreadcrumbList", "@id": "https://update.dsesecurity.com/updates/dse-20260908-217-interpret-hyper-v-extended-acl-direction-from-the-vm-perspective/#breadcrumbs", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "DSE Updates", "item": "https://update.dsesecurity.com/" }, { "@type": "ListItem", "position": 2, "name": "Interpret Hyper-V extended ACL direction from the VM perspective", "item": "https://update.dsesecurity.com/updates/dse-20260908-217-interpret-hyper-v-extended-acl-direction-from-the-vm-perspective/" } ] }, { "@type": [ "Article", "TechArticle" ], "@id": "https://update.dsesecurity.com/updates/dse-20260908-217-interpret-hyper-v-extended-acl-direction-from-the-vm-perspective/#article", "identifier": "https://update.dsesecurity.com/updates/dse-20260908-217-interpret-hyper-v-extended-acl-direction-from-the-vm-perspective/", "url": "https://update.dsesecurity.com/updates/dse-20260908-217-interpret-hyper-v-extended-acl-direction-from-the-vm-perspective/", "headline": "Interpret Hyper-V extended ACL direction from the VM perspective", "description": "How should an extended virtual-switch ACL define traffic direction and scope?", "abstract": "How should an extended virtual-switch ACL define traffic direction and scope?", "articleBody": "Source facts\nMicrosoft documents extended ACLs applied to individual VM network adapters on a Hyper-V virtual switch. The rules can match source and destination addresses, protocol, and source and destination ports. In the documented direction convention, inbound means traffic received by the VM and outbound means traffic sent from it. Microsoft Learn.\nApplicability\nIdentify the precise VM adapter and application flow before writing a rule. Review source, destination, protocol, and both port roles from that VM’s perspective. Keep an ACL on the virtual adapter distinct from a host firewall rule or a physical-network filter.\nDSE recommendation\nWrite the intended allowed and denied flows in a small matrix and have a second reviewer translate each into the documented direction convention. Preserve the existing adapter ACLs and name the rollback owner. Pilot one application path, including the reply traffic and a deliberately prohibited source. Avoid broadening a rule simply because its first test was written in the wrong direction.\nVerification\nGenerate the approved test flows from both sides of the VM boundary and record the effective rule and result. Confirm an excluded flow remains blocked while the required transaction works. Recheck the exact adapter association after configuration and document any other filter that affected the observed outcome.\nOfficial references\nMicrosoft Learn: Create Security Policies with Extended Port Access Control Lists. Source reviewed September 8, 2026.", "datePublished": "2026-09-08T18:13:34+00:00", "dateModified": "2026-09-08T18:29:33+00:00", "mainEntityOfPage": { "@id": "https://update.dsesecurity.com/updates/dse-20260908-217-interpret-hyper-v-extended-acl-direction-from-the-vm-perspective/" }, "inLanguage": "en-US", "isAccessibleForFree": true, "author": { "@type": "Organization", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team" }, "publisher": { "@id": "https://dsesecurity.com/#organization" }, "image": { "@type": "ImageObject", "@id": "https://update.dsesecurity.com/updates/dse-20260908-217-interpret-hyper-v-extended-acl-direction-from-the-vm-perspective/#primaryimage", "url": "https://update.dsesecurity.com/assets/editorial/continuity-recovery-social-v2.jpg?v=1.8.20", "contentUrl": "https://update.dsesecurity.com/assets/editorial/continuity-recovery-social-v2.jpg?v=1.8.20", "width": 1200, "height": 630, "caption": "Interpret Hyper-V extended ACL direction from the VM perspective" }, "articleSection": [ "Business Continuity", "IT" ], "keywords": [ "Business Continuity", "IT", "Guide", "Information priority" ], "genre": "Guide", "about": [ { "@type": "Thing", "name": "Business Continuity", "url": "https://update.dsesecurity.com/topic/business-continuity/" }, { "@type": "Thing", "name": "IT", "url": "https://update.dsesecurity.com/topic/it/" } ], "wordCount": 221, "timeRequired": "PT2M", "publishingPrinciples": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usageInfo": "https://update.dsesecurity.com/usage/", "copyrightHolder": { "@id": "https://dsesecurity.com/#organization" }, "copyrightNotice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "citation": { "@type": "CreativeWork", "name": "Create Security Policies with Extended Port Access Control Lists", "url": "https://learn.microsoft.com/en-us/windows-server/virtualization/hyper-v/create-security-policies-extended-port-access-control-lists" } } ] } }