AWS Network ACLs: How They Work and How to Configure Them
AWS network access control lists (network ACLs, or NACLs) provide a layer of traffic filtering for subnets in an Amazon Virtual Private Cloud (VPC). They let you allow or deny network traffic entering or leaving a subnet. Used alongside security groups, NACLs can help enforce network boundaries and reduce unwanted access.
What Is a Network ACL?
A network ACL is a set of numbered rules associated with one or more VPC subnets. Each subnet is associated with exactly one network ACL at a time. If you do not explicitly associate a subnet with a different ACL, it uses the VPC’s default network ACL.
NACLs filter traffic at the subnet boundary. They apply to traffic traveling to and from resources in the subnet, rather than acting as a firewall configured on an individual instance. They can filter IPv4 and IPv6 traffic when the relevant rules are defined.
How NACL Rules Work
Each rule specifies a rule number, a protocol, a port range or ICMP type, a source or destination CIDR block, and an action: allow or deny. Inbound and outbound rules are configured separately.
- Rules are evaluated in ascending numerical order. The first rule that matches the traffic is applied, so more specific rules should generally have lower numbers than broader rules.
- The asterisk (*) rule is the final rule. It applies if no numbered rule matches. You cannot delete it, but its action can be changed.
- Rules are stateless. Allowing traffic in one direction does not automatically allow the response in the other direction. The return traffic must match a rule in the opposite direction.
For example, an inbound rule allowing HTTPS does not automatically permit outbound response packets. The outbound rules must also allow the response traffic.
Default and Custom Network ACLs
A VPC’s default network ACL allows all inbound and outbound traffic by default. You can modify its rules, but changes affect every subnet associated with it.
A custom network ACL denies all inbound and outbound traffic by default. You must add rules to allow the traffic your workloads need. This default-deny behavior can be useful when you want to define explicit subnet-level controls.
NACLs and Security Groups
Network ACLs and security groups both control network traffic, but they work differently:
- Network ACLs apply at the subnet level, support both allow and deny rules, and are stateless.
- Security groups apply to network interfaces associated with resources, support allow rules only, and are stateful. Response traffic for an allowed connection is automatically permitted.
These controls can complement each other. For example, a NACL can set broad subnet boundaries, while security groups allow only the traffic needed by specific application components. Avoid creating overlapping rules without a clear reason, since doing so can make troubleshooting harder.
Example: Allowing Web Traffic
Suppose a public subnet contains a web server that should accept HTTP and HTTPS traffic from the internet. A simplified NACL policy might include:
- Inbound: Allow TCP traffic on ports 80 and 443 from the intended client CIDR ranges.
- Outbound: Allow the response traffic to client ephemeral ports.
- Other traffic: Deny traffic that is not permitted by a matching rule.
Because NACLs are stateless, the return path matters. For a client connecting to the server, the request arrives at port 80 or 443, while the response is sent to an ephemeral port chosen by the client. The NACL must allow that outbound response. For connections initiated by the server, the inbound response traffic will also need to be allowed to the server’s ephemeral port range.
Ephemeral port ranges vary by operating system and configuration. Use the range required by your clients and workloads rather than assuming one range fits every environment. Also consider whether the subnet needs access to other services, such as DNS, application dependencies, or AWS service endpoints.
Best Practices
- Start with least privilege. Allow only the protocols, ports, and CIDR ranges required for the workload.
- Plan rule numbers carefully. Place specific rules before broader rules because the first matching rule takes effect.
- Account for return traffic. Review both inbound and outbound rules, including ephemeral ports where needed.
- Consider IPv4 and IPv6 separately. Add appropriate rules for each address family used in the VPC.
- Test changes before broad rollout. A restrictive rule can interrupt application traffic or access to dependencies.
- Use security groups for resource-level controls. NACLs are a subnet-level control and do not replace instance- or interface-level rules.
- Document the policy. Record why each rule exists and which application or traffic flow depends on it.
Troubleshooting NACLs
If traffic is unexpectedly blocked, check that the subnet is associated with the intended network ACL and review the inbound and outbound rule lists in numerical order. Confirm that the correct protocol, port range, and CIDR block are specified, and verify that the return path is permitted. Also check the resource’s security group and the rest of the network path, including routing and any firewalls.
VPC Flow Logs can help identify traffic that is accepted or rejected at network interfaces. Use them alongside application logs and AWS networking configuration to narrow down where a connection is failing.
Conclusion
AWS network ACLs offer subnet-level traffic filtering with explicit allow and deny rules. Their stateless behavior makes it essential to account for both directions of a connection, while ordered rules make careful rule numbering important. When designed alongside security groups and tested against real application traffic, NACLs can provide a useful additional layer of control for VPC networks.
AWS Network ACLs Explained: Definitions, VPC Firewalls, and Security Group Differences
- What are network ACLs in AWS?
- What does ACL AWS stand for?
- What is ACL in AWS?
- What is the difference between network ACLs and security groups in AWS?
- What does AWS ACL stand for?
- Is network ACL a firewall?
- What is VPC network ACL?
What are network ACLs in AWS?
Network access control lists (network ACLs or NACLs) are optional subnet-level filters in an Amazon VPC. They control inbound and outbound traffic using numbered rules that allow or deny traffic based on details such as protocol, port, and IP address range. NACLs are stateless, so you must configure rules for both the request and its return traffic. They complement security groups, which apply to individual network interfaces and are stateful.
What does ACL AWS stand for?
In AWS, ACL stands for “Access Control List.” A network ACL (NACL) is a set of rules that controls inbound and outbound traffic at the subnet level in a virtual private cloud (VPC). NACLs are stateless, so rules must allow both the request and its return traffic.
What is ACL in AWS?
In AWS, an access control list (ACL) is a set of rules that controls network traffic. A network ACL, or NACL, applies to a VPC subnet and evaluates inbound and outbound traffic using numbered allow or deny rules. NACLs are stateless, so rules must permit both the request and its return traffic. They provide subnet-level filtering and complement security groups, which control traffic at the resource level.
What is the difference between network ACLs and security groups in AWS?
In AWS, network ACLs (NACLs) and security groups control traffic at different levels. A NACL applies to a subnet, supports both allow and deny rules, and is stateless, so inbound and outbound traffic must be allowed separately. A security group applies to resources such as EC2 network interfaces, supports allow rules only, and is stateful, so response traffic is automatically permitted for an allowed connection. They can be used together: NACLs provide subnet-level filtering, while security groups offer more targeted access control for individual resources.
What does AWS ACL stand for?
In AWS, ACL stands for “access control list.” A network ACL, or NACL, is a set of rules that controls inbound and outbound traffic at the subnet level within a VPC. Unlike security groups, network ACLs are stateless, so rules must account for both incoming traffic and the return traffic.
Is network ACL a firewall?
Yes. An AWS network ACL acts as a basic, subnet-level firewall for traffic entering and leaving a VPC subnet. It uses numbered rules to allow or deny traffic based on factors such as protocol, port, and IP address range. Unlike security groups, network ACLs are stateless, so rules must account for both incoming traffic and its return traffic. They provide one layer of network protection, but they don’t replace security groups or other security controls.
What is VPC network ACL?
A VPC network access control list (network ACL or NACL) is a subnet-level firewall in Amazon Virtual Private Cloud (VPC) that controls inbound and outbound traffic. It uses numbered rules to allow or deny traffic based on details such as protocol, port, and IP address range. Network ACLs are stateless, so rules must account for both the request and its return traffic. They can be used alongside security groups to add another layer of network protection.