Network ACLs: A Stateless Firewall for Subnets
A Network ACL (NACL) is a firewall for an entire cloud subnet, checking traffic as it enters or leaves. It's used for broad, stateless rules, like blocking a malicious IP from all instances.
Why it exists
Cloud networks need multiple layers of security (defense in depth). While security groups act as a firewall for individual instances, Network Access Control Lists (NACLs) were created to provide a broader, more efficient firewall at the boundary of an entire subnet.
The mental model
A NACL is like a bouncer for a whole neighborhood (a subnet), not just a single building. This bouncer checks everyone's ID as they enter or leave the neighborhood perimeter. Crucially, the bouncer has no memory; they check every single entry and exit, even if it's the response to a request they just allowed. This is what 'stateless' means.
How it works
A NACL is a numbered list of rules associated with one or more subnets. It has separate lists for inbound and outbound traffic. When a packet tries to cross the subnet boundary, the NACL evaluates its rules in numerical order, from lowest to highest (1-32766). The first rule that matches the traffic is applied, and all other rules are ignored. Because NACLs are stateless, allowing an inbound request does not automatically allow the outbound response. You must create an explicit outbound rule for that return traffic.
When to use it
Use NACLs as an additional security layer to enforce broad policies on a subnet. They are effective for blocking traffic from known malicious IP addresses or ranges before that traffic can even reach any of your instances. This is a simple way to blacklist IPs at the network edge.
When not to use it
Do not use NACLs for fine-grained, application-specific rules on a per-instance basis; that is the job of stateful Security Groups. NACLs also cannot filter certain AWS-managed traffic, such as requests to the internal DNS resolver or instance metadata service.
One canonical example
Imagine a web server in a subnet needs to accept web traffic. The NACL's inbound rules must allow traffic on port 80 from the internet (0.0.0.0/0). Because the NACL is stateless, you must also add an outbound rule allowing traffic on ephemeral ports (1024-65535) back to the internet. If you forget the outbound rule, the web server's HTTP responses will be blocked, and the connection will fail.
Interview question
Which statement accurately describes a critical configuration requirement for a Network ACL (NACL) to allow a web server in its associated subnet to successfully respond to incoming HTTP requests?
- a.The inbound rule allowing HTTP traffic must have a lower rule number than any other inbound rule to ensure it's processed first.
- b.A separate NACL must be created for each individual web server instance to manage its specific traffic.
- c.Only an inbound rule allowing HTTP traffic on port 80 is necessary, as NACLs automatically permit return traffic for established connections.
- d.Both an inbound rule allowing HTTP traffic on port 80 and an outbound rule allowing traffic on ephemeral ports (1024-65535) must be explicitly defined.Correct
Why? this is the answer
NACLs are stateless, meaning they do not remember previous connections. Therefore, to allow a web server to respond to an inbound HTTP request, explicit outbound rules for the return traffic on ephemeral ports must be configured in addition to the inbound HTTP rule. Option C describes the behavior of stateful firewalls like Security Groups, not NACLs.
Just read this? Test yourself on what you have been reading.
Read the original → docs.aws.amazon.com
You just looked this up. Could you explain it out loud?
That is the part interviews actually test. Tezvyn takes questions like this one and gives you what the interviewer is really checking, the answer that lands, and the mistake that ends the conversation, in the four minutes before your next meeting.
The iPhone app is on the way
We are building it. Until it lands, nothing here is held back from you: every interview card, your saved cards, streaks and the job board all work in Safari, plus hundreds of free practice quizzes of thirty questions each. Sign in and it all carries over to the app the day it arrives.
Want it as an icon? Tap Share at the bottom of Safari, then Add to Home Screen. It opens full screen and the cards you have read stay available offline.
We are hiring for this. Open roles that interview on cloud — each one lists the topics its interview covers.
See open roles