Network ACLs

A hand-drawn animated video with a voice and subtitles. Every fact in it comes from the official AWS documentation (listed at the end).

TL;DR

A network ACL (access control list) allows or denies traffic at the subnet level: it is the guard at the building gate, not at one flat's door.
Every subnet has exactly one network ACL at a time. One network ACL can serve many subnets.
Rules are numbered 1 to 32766 and read lowest number first. The first rule that matches wins; later rules are not read.
Rules can allow or deny. A last rule numbered * (asterisk) denies anything no numbered rule matched. You cannot delete it.
Network ACLs are stateless (no memory): a reply needs its own rule, usually for the client's ephemeral ports (the port range the client picks for replies).
The default network ACL allows all traffic. A new custom one blocks all traffic until you add rules.

0:00

Video file: aws-understand/06-networking/22-network-acls/video.mp4

The ideas

01The picture, part by part

Same picture as the other networking videos AWS docs

AWS word	In the picture	What AWS docs say
Subnet	A building	A range of IP addresses in a VPC. You launch an instance into a subnet.
Network ACL	Guard at the building gate, with a numbered rule list	Allows or denies specific inbound or outbound traffic at the subnet level.
Security group	Guard at the flat door	Works at the instance level, allow rules only, stateful (topic 25).
Inside the building	A letter from one flat to another	Rules are checked "when traffic enters and leaves the subnet, not as it is routed within a subnet".

Custom network ACLs "add an additional layer of security to your VPC". There is no extra charge for using network ACLs.

Source: vpc-network-acls.html, infrastructure-security.html

02One subnet, one network ACL

Many subnets can share one list AWS docs

Question	Answer
Must every subnet have a network ACL?	Yes. If you do not pick one, it gets the default network ACL.
Can one network ACL serve many subnets?	Yes.
Can one subnet have two network ACLs?	No. Only one at a time. Attaching a new one removes the old link.
Rules per network ACL (default quota)	20 inbound and 20 outbound; can be raised to 40 each.

Source: vpc-network-acls.html ("Network ACL basics"), amazon-vpc-limits.html ("Network ACLs")

03Rule order and the star rule

Lowest number first, first match wins AWS docs

Inbound rules from the AWS docs example (IPv4 rows only; the docs also show IPv6 rows, which are checked separately):

Rule #	Type	Port	Source	Allow or deny
`100`	HTTP	`80`	`0.0.0.0/0`	ALLOW
`110`	HTTPS	`443`	`0.0.0.0/0`	ALLOW
`120`	SSH	`22`	`192.0.2.0/24`	ALLOW
`140`	Custom TCP	`32768-65535`	`0.0.0.0/0`	ALLOW
`*`	All traffic	All	`0.0.0.0/0`	DENY

Traffic	What happens (from the AWS docs)
To port `443`	Does not match rule `100`. Matches rule `110` → allowed. No later rule is read.
To port `139`	Matches no numbered rule → the `` rule denies* it.

Rule numbers go from 1 to 32766. AWS suggests gaps (for example 100, 200, 300) so you can add a rule in between later.
To block a few ports inside a wide allowed range, give the deny rule a lower number than the allow rule. If the deny rule had a higher number, the allow rule would match first and the deny rule would never be reached.
You cannot delete the * rule.

Source: vpc-network-acls.html, nacl-rules.html, custom-network-acl.html, create-network-acl.html

04Default vs custom

Open by default, closed when new AWS docs

	Default network ACL	New custom network ACL
Where it comes from	Comes with your VPC	You create it
Starting rules	`100` ALLOW all, then `*` DENY (in and out)	Only `*` DENY: blocks all inbound and outbound traffic
Attached to subnets?	Any subnet you did not attach to another ACL	None, until you attach it

Source: default-network-acl.html, create-network-acl.html ("Step 1")

05Stateless and ephemeral ports

The guard has no memory AWS docs

Stateless means "information about previously sent or received traffic is not saved". So if you allow some inbound traffic, the replies to it are not allowed by themselves. AWS example (one trusted computer, 172.31.1.2/32):

List	Rule #	Port	Address	Allow or deny	Why
Inbound	`100`	`22` (SSH)	`172.31.1.2/32`	ALLOW	Let the trusted computer in
Outbound	`100`	`1024-65535`	`172.31.1.2/32`	ALLOW	Let the replies go back out

Ephemeral ports: the client that starts a request chooses the port range for the reply. The range depends on its operating system:

Client	Ephemeral port range
Many Linux kernels (including Amazon Linux)	`32768-61000`
Windows Server 2008 and later	`49152-65535`
NAT gateway, Elastic Load Balancing, AWS Lambda	`1024-65535`

To cover all kinds of clients, you can open 1024-65535, and add deny rules for bad ports earlier in the list.

Source: vpc-network-acls.html, nacl-examples.html, custom-network-acl.html ("Ephemeral ports")

06Network ACL vs security group

Two guards, two jobs AWS docs

Characteristic	Security group	Network ACL
Level	Instance level	Subnet level
Rule types	Allow rules only	Allow and deny rules
How rules are checked	All rules, before deciding	In ascending number order, until a match
Return traffic	Allowed automatically (stateful)	Must be allowed by a rule (stateless)

AWS says: use security groups as the main way to control network access. Use network ACLs as a secondary control, for example to deny a specific set of traffic. Because a network ACL covers a whole subnet, it still protects you if an instance gets the wrong security group, for example if someone opens SSH to everyone by mistake.

Source: infrastructure-security.html ("Compare security groups and network ACLs", "Control network traffic"), nacl-examples.html

Reference

—Sources

What	Where (official AWS docs)
Network ACL basics: subnet level, one per subnet, rule numbers, stateless	vpc/latest/userguide/vpc-network-acls.html
Parts of a rule, order, deny before allow	vpc/latest/userguide/nacl-rules.html
Default network ACL and the `*` rule	vpc/latest/userguide/default-network-acl.html
Custom network ACL example, ephemeral ports	vpc/latest/userguide/custom-network-acl.html
New custom ACL blocks all, gaps between rule numbers	vpc/latest/userguide/create-network-acl.html
SSH example with outbound reply rule	vpc/latest/userguide/nacl-examples.html
Security groups vs network ACLs, primary vs secondary control	vpc/latest/userguide/infrastructure-security.html
Rules per network ACL quota	vpc/latest/userguide/amazon-vpc-limits.html