1. A method for computing network reachability between a pair of subnetworks in a computer network, comprising: determining data paths between a first subnetwork of interest in the computer network and a second subnetwork of interest in the computer network; identifying, for each data path, access control lists implemented along a given data path, where each access control list is a set of rules for filtering network packets and each rule in the set of rules sets forth values for fields in a network packet and a decision for packets having matching field values; computing, for each data path, a diagram that merges reachability sets derived from the access control lists along a given data path; and reducing domain for each of the diagrams to a set of network addresses used in the first subnetwork and the second subnetwork and deriving a set of network packets that can traverse from the first subnetwork to the second subnetwork from each of the reduced diagrams, wherein each step is implemented by processor-executable instructions executed by a computer processor.