AWS Network ACLs

Stateless rule evaluation, numbered rules, explicit allow and deny, ephemeral port ranges, and differences from security groups.

Overview

Overview AWS Network Access Control Lists (NACLs) are stateless subnet-level firewalls that provide an additional layer of network security beyond Security Groups. NACLs operate at the subnet boundary and inspect each packet independently without tracking connection state.

Every subnet in a VPC is associated with exactly one NACL. The VPC's default NACL allows all inbound and outbound traffic by default. NACLs affect all instances in the subnet regardless of their individual security group configurations.

The stateless nature of NACLs has a critical practical implication: you must write rules for both the request and the response direction. For a web server receiving HTTPS on port 443, you need an inbound ALLOW rule for port 443, but you also need an outbound ALLOW rule for the ephemeral port range (1024-65535) so the server's response can exit the subnet. The client's source port is an ephemeral port chosen by the OS — typically 32768-60999 on Linux or 49152-65535 on Windows. Forgetting this ephemeral port outbound rule is the most common NACL mistake.

NACL rules are evaluated in ascending numeric order (lowest number first). The first rule that matches determines the action — ALLOW or DENY. After a matching rule is found, no further rules are evaluated. NACLs support explicit DENY rules (Security Groups do not). There is always an implicit DENY at the end (rule *) that drops all unmatched traffic.

NACLs are best used as a coarse-grained subnet boundary control and IP blocklist mechanism, complementing the fine-grained per-instance control provided by Security Groups.

Key concepts

Stateless evaluation: NACLs do not track TCP connection state. Every packet is evaluated independently. You must write explicit allow rules for both directions — including outbound ephemeral ports for server responses. Return traffic is NOT automatically allowed.
Numbered rules, first-match wins: Rules are evaluated from lowest number to highest. The first rule that matches determines the action. Rule numbers 1-32766 are user-configurable; rule 32767 is an implicit deny-all.
Explicit ALLOW and DENY: Unlike Security Groups (allow-only), NACLs support both ALLOW and DENY actions. This enables IP blocklisting — a DENY rule with a lower number blocks specific sources while higher-numbered ALLOW rules permit others.
Ephemeral ports: TCP/UDP clients use an ephemeral (temporary) source port for each connection. Linux: 32768-60999. Windows: 49152-65535. When a server responds, the response destination port is this ephemeral port. Outbound NACL rules must allow this range.
Subnet association: Each subnet is associated with exactly one NACL. A NACL can be associated with multiple subnets. Changing a subnet's NACL association takes effect immediately for new connections.

When to use it

Blocking specific IP ranges (known attackers, Tor exit nodes) at the subnet level
Adding defense in depth where a misconfigured security group should not expose all subnet traffic
Restricting traffic between subnets in a VPC
Troubleshooting connectivity failures caused by NACL rules
Understanding why adding an inbound allow rule alone is not sufficient

Interview questions

A web server in a private subnet can receive HTTPS connections but the responses never reach clients. What is the most likely cause and how do you fix it?
How do you use NACLs to block a specific IP range that is attacking your application, and how quickly does the block take effect?

AWS Network ACLs

Overview

Key concepts

When to use it

Interview questions

More Networking topics