Network Access Control Lists

Default NACL

Custom NACL

• An optional security layer in your VPC.

• Acts as a stateless firewall for controlling inbound and outbound traffic at the subnet level.

---

🧱 How It Works

• Applies to one or more subnets in a VPC.

• Controls traffic entering and leaving subnets, based on defined rules.

• Rules can allow or deny traffic based on:

  • Protocol

  • Port range

  • Source/Destination IP

---

🔁 Key Characteristics

• Stateless: Return traffic must be explicitly allowed.

• Rule order matters: Rules are evaluated in order, starting from the lowest number.

• Can be used to complement security groups (which are stateful).

---

🧠 Quick Summary

Feature	Description
Purpose	Firewall at the subnet level
Type	Stateless (both inbound & outbound rules needed)
Rule Evaluation	Evaluated in number order (lowest first)
Use Case	Add an extra layer of security beyond security groups
Allows/Deny Traffic	Yes, both (unlike security groups which only allow)