NACLs

NACLs, or network access control lists, are subnet-level firewalls used in many cloud and virtual network environments. They provide stateless filtering of traffic entering and leaving a subnet, using explicit allow and deny rules. NACLs work in conjunction with security groups, which operate at the instance level and are stateful.

Each NACL has two separate rule sets: inbound and outbound. A rule specifies the protocol (such as TCP, UDP, ICMP, or all), a port range, a source or destination CIDR block, and an action (allow or deny). Rules are evaluated in order of rule number from lowest to highest, and the first matching rule determines the traffic outcome. If no rule matches a given traffic flow, the traffic is denied by default (implicit deny). In many cloud environments, a default NACL allows all traffic, while a custom NACL starts with a deny-all posture until you add rules.

NACLs are associated with one or more subnets within a virtual network. All resources in a subnet share the same NACL. Because NACLs are stateless, return traffic must be explicitly allowed by the corresponding outbound or inbound rules; security groups handle stateful tracking of established connections, but do not replace the need for NACL rules at the subnet boundary.

Common use cases include blocking known bad IP ranges, segmenting subnets with restricted access, and providing a coarse-grained protection layer in addition to instance-level security groups. When designing networks, operators typically use NACLs to complement security groups, balancing broad subnet controls with granular per-instance policies.