NACLs and SecGroups

In this lesson you’ll learn the differences between Network ACLs (NACLs) and Security Groups in AWS, how they behave, and when to use each to protect resources inside a VPC.

​

What is a Network ACL (NACL)?

A Network Access Control List (NACL) is a stateless, subnet-level firewall for your VPC. NACLs control traffic entering and leaving a subnet and can be associated with one or more subnets in the same VPC. Because they are associated at the subnet level, a single NACL can be reused across multiple subnets that require the same traffic controls. Each NACL contains an ordered list of rules. Each row in a NACL rule table contains:

• Rule number (priority — lower numbers are evaluated first)
• Type (protocol/service)
• Protocol (TCP/UDP/ICMP/All)
• Port range
• Source or destination (CIDR)
• Action (Allow or Deny)

NACLs evaluate rules in ascending order and apply the first matching rule. If no rule matches the traffic, there is an implicit deny. The image above illustrates a default NACL rule set: by default a newly created VPC and subnets receive a default NACL that allows all inbound and outbound traffic. You can modify these default rules or replace the NACL to restrict traffic as needed.

​

Two primary AWS firewall mechanisms

• NACLs: operate at the subnet level — filter traffic entering and leaving subnets (stateless).
• Security Groups: operate at the resource (ENI/instance) level — control inbound and outbound traffic for the resource (stateful).

​

Key behavioral differences (at a glance)

​

Security Groups — deeper dive

Security groups act as virtual firewalls attached to resources (EC2, ENIs, etc.) to control inbound and outbound traffic. They are stateful: if an inbound packet is allowed, the response is automatically allowed as part of the same connection. Key points:

• A single security group can be attached to multiple instances to simplify management (e.g., one security group for all web servers).
• A single instance can have multiple security groups attached; effective permissions are the union of their allow rules.
• Security groups are scoped to a VPC — you cannot attach a security group from another VPC directly.
• Rules are defined as separate Inbound and Outbound sections and include protocol, port range, and source/destination (CIDR or another security group).

Example inbound rule (common example, not recommended for production): allow SSH from anywhere. Outbound rules are defined in the same format but control egress traffic originating from the instance.

​

Services exempt from security group filtering

Certain AWS-managed endpoints or services are not filtered by security groups; traffic to and from these services is allowed regardless of security group rules. Examples include:

• Amazon DNS servers
• Amazon DHCP
• EC2 instance metadata service
• ECS task metadata endpoints
• Windows license activation services
• Amazon Time Sync Service
• Reserved IP addresses used by the default VPC router

​

Practical guidance and troubleshooting

• Default behaviors:
  • Default NACL: allows all inbound and outbound traffic until you modify it.
  • New custom security group: denies all inbound traffic and allows all outbound traffic by default.
• When to use which:
  • Use NACLs for broad, stateless subnet-level controls or to quickly block entire IP ranges.
  • Use Security Groups for stateful, resource-level, fine-grained access control.
• Troubleshooting checklist:
  1. Check the instance’s security group inbound/outbound rules.
  2. Check the subnet’s NACL inbound/outbound rules.
  3. Verify routing and network ACL rule ordering (remember numbered NACL rules).
  4. Confirm there are no other network appliances (NAT, firewalls) blocking traffic.
  5. Check whether traffic involves exempted AWS endpoints (these bypass security groups).

This lesson covered the core differences, default behaviors, rule evaluation, and recommended use cases for NACLs and Security Groups so you can design secure and predictable networking controls in your VPC.

​

Links and references

• AWS VPC Security Groups documentation
• AWS Network ACLs documentation
• Kubernetes Basics (for general networking concepts)