title: “VPC Network ACLs” created: 2026-07-22 updated: 2026-07-22 type: knowledge tags:
- aws
- certification
- networking
- vpc
VPC Network ACLs
What It Is
A Network Access Control List (NACL) is an optional stateless firewall that controls inbound and outbound traffic at the subnet level. Every subnet in a VPC is associated with a NACL.
Why It Matters
NACLs provide an additional layer of defense beyond security groups. Understanding the difference between NACLs (stateless, subnet-level) and security groups (stateful, instance-level) is critical for both exam preparation and real-world VPC design.
Key Concepts
Stateless vs Stateful
| Feature | Network ACL | Security Group |
|---|---|---|
| Level | Subnet | Instance |
| Stateful | No — must allow return traffic explicitly | Yes — return traffic auto-allowed |
| Rule type | Allow AND Deny | Allow only (implicit deny) |
| Evaluation | Rules processed in number order | All rules evaluated together |
Rule Structure
| Field | Description |
|---|---|
| Rule number | Priority (lower = evaluated first) |
| Type | Traffic type (e.g., All Traffic, HTTP, SSH) |
| Protocol | TCP, UDP, ICMP, etc. |
| Port range | Destination port(s) |
| Source/Destination | CIDR block |
| Allow/Deny | Action to take |
Default NACL
The default NACL (created with the VPC) allows all inbound and outbound traffic:
| Rule # | Direction | Action | Traffic | CIDR |
|---|---|---|---|---|
| 100 | Inbound | Allow | All | 0.0.0.0/0 |
| 100 | Outbound | Allow | All | 0.0.0.0/0 |
| * | Both | Deny | All | 0.0.0.0/0 |
The * rule is the catch-all: if no numbered rule matches, traffic is denied.
Custom NACL
A newly created custom NACL denies all traffic by default (only has the * deny rule). You must explicitly add allow rules.
Rule Evaluation Order
- Rules are evaluated in ascending order by rule number
- First matching rule wins (stops evaluation)
- If no rule matches, the
*catch-all denies the traffic
Ephemeral Ports
Because NACLs are stateless, you must allow ephemeral ports (1024–65535) for return traffic on outbound rules when a client connects to a service.
Gotchas
- NACLs are stateless — allowing inbound HTTP (port 80) does NOT automatically allow the response on ephemeral ports
- The default NACL allows everything; a custom NACL denies everything — easy to confuse
- Rule numbers should use increments (e.g., 100, 200, 300) to leave room for insertion
- A subnet can only be associated with one NACL at a time
- NACLs apply to all instances in the subnet — cannot target specific instances
See Also
- [[vpc-security-groups]]
- [[vpc-subnets]]
- [[vpc-fundamentals]]
- [[vpc-route-tables]]