NACL to subnet is one to many There is a default NACL associated with subnets