networking - Network ACLs for private subnet (with NAT Gateway)

I have created two subnets in my vpc (10.11.0.0/22)

• public subnet - 10.11.0.128/27


• private subnet - 10.11.0.0/26

I have also created the NAT gateway in public subnet and attached it to private subnet so that instances in private subnet can access the internet.

So everything is working, I have created Linux instance in public subnet and I can do ssh and also access internet. Same is the case with private subnet instances, I can login to private instances through public instances.

But after applying Network ACLs

Inbound Rules

Outbound Rules

I can access the internet from my public instances but could not access it through the private instance.

What would be correct Network ACLs for in order to access internet from private instances?