📖 What is Network Access Control List (NACL)?
A Network Access Control List (NACL) is an optional layer of security for a VPC that acts as a firewall for controlling traffic in and out of one or more subnets. Unlike security groups, NACLs are stateless and operate at the subnet level.
"Because NACLs are stateless, you must explicitly define both inbound and outbound rules for traffic to flow, making them more complex to manage than security groups."
📚 Certification: CCSP (CCSP)
🔑 What are the Key Concepts of Network Access Control List (NACL)?
- ▸ Stateless nature requires explicit rules for both inbound and outbound traffic, meaning return traffic must be allowed via ephemeral ports to function correctly.
- ▸ Operates at the subnet level, acting as a coarse-grained security perimeter that affects all instances and resources residing within that specific subnet.
- ▸ Supports both 'Allow' and 'Deny' rules, providing the ability to explicitly blacklist specific IP addresses or ranges from accessing the cloud environment.
- ▸ Rules are processed in numerical order from lowest to highest; the first matching rule is applied, and subsequent rules are ignored.
- ▸ Provides a critical layer of defense-in-depth when combined with stateful security groups, creating a multi-layered firewall strategy for cloud workloads.
🎯 How does Network Access Control List (NACL) appear on the CCSP Exam?
You may be asked to identify the best tool for blocking a specific range of malicious IP addresses from entering a subnet, where you must choose NACL over security groups due to the need for explicit 'Deny' rules.
A scenario might describe a connectivity issue where inbound traffic is allowed, but responses are failing. You will need to identify that the NACL lacks the necessary outbound rules for ephemeral ports.
❓ Frequently Asked Questions
Why can't I just use Security Groups instead of NACLs?
Security groups only support 'Allow' rules and operate at the instance level. NACLs provide a subnet-wide layer of security and the ability to explicitly 'Deny' traffic, which is essential for blocking known attackers.
How does rule ordering affect traffic flow in a NACL?
NACLs evaluate rules numerically. If rule 10 denies traffic and rule 20 allows it, the traffic is blocked because rule 10 is processed first. This makes the sequence of rule numbers critical for correct configuration.