📖 What is Network Access Control List (NACL)?
A Network Access Control List (NACL) is an optional layer of security for your VPC that acts as a stateless firewall for controlling traffic in and out of one or more subnets. It processes inbound and outbound traffic based on a numbered list of rules, evaluating them in sequential order.
"Remember that NACLs are stateless. If you allow inbound traffic on port 80, you must explicitly allow outbound traffic on ephemeral ports for the response to return."
📚 Certification: AWS Certified Solutions Architect - Associate (SAA-C03)
🔑 What are the Key Concepts of Network Access Control List (NACL)?
- ▸ Stateless nature requires that both inbound and outbound traffic be explicitly allowed, as the NACL does not remember the state of connections.
- ▸ Operates at the subnet level, acting as a coarse-grained firewall that controls traffic entering or leaving all instances within that specific subnet.
- ▸ Rules are processed in ascending numerical order; the first rule that matches the traffic is applied, and all subsequent rules are ignored.
- ▸ Supports both 'Allow' and 'Deny' rules, providing the ability to explicitly block specific IP addresses or CIDR blocks from accessing the network.
- ▸ Requires configuration of ephemeral ports (typically 1024-65535) for outbound rules to allow response traffic to return to the original client.
🎯 How does Network Access Control List (NACL) appear on the SAA-C03 Exam?
A scenario might describe a security requirement to explicitly block a specific malicious IP address from entering your VPC; you should select NACL as the solution because Security Groups only support 'Allow' rules.
You may be asked to troubleshoot a connectivity issue where an instance can receive traffic but cannot respond; the solution typically involves adding an outbound rule for ephemeral ports in the NACL.
Expect questions regarding 'defense in depth' where you must implement both Security Groups for instance-level stateful filtering and NACLs for subnet-level stateless filtering.
❓ Frequently Asked Questions
If I allow port 80 in a Security Group, do I still need to configure the NACL?
Yes, if a NACL is associated with the subnet, it must also allow port 80 inbound and the ephemeral port range outbound. Traffic must pass through both the NACL and the Security Group to reach the instance.
What happens if there are no custom rules defined in a NACL?
The behavior depends on the type: the default NACL allows all inbound and outbound traffic, while a custom NACL denies all traffic by default until you add allow rules.
Can a single NACL be associated with multiple subnets?
Yes, a single NACL can be associated with multiple subnets. This allows you to apply a consistent security policy across several subnets simultaneously to simplify management.