Security Specialty
AWS Network ACL (NACL) Best Practices: Rule Numbers, Ephemeral Ports and Examples
Network ACLs are stateless subnet firewalls evaluated from the lowest rule number, first match wins. Best practices: number rules in steps of 10 or 100, always allow the return traffic on ephemeral ports, place deny rules before broad allow rules, and use security groups as your main instance-level control.
How network ACLs work
- A NACL allows or denies inbound and outbound traffic at the subnet level, at no additional charge.
- Every subnet must be associated with exactly one NACL; without an explicit association it uses the default NACL. One NACL can cover many subnets.
- Rules are numbered 1 to 32766 and evaluated from the lowest number; the first match applies and no other rule is evaluated.
- NACLs are stateless: allowing inbound traffic does not allow the response. Security groups are stateful.
- Rules are evaluated when traffic enters and leaves the subnet, not as it is routed within the subnet.
Default vs custom NACL
| Default NACL | Custom NACL | |
|---|---|---|
| Created | Automatically with the VPC | By you |
| Starting rules | Rule 100 allows all inbound and all outbound traffic | Only the * rules, so everything is denied until you add rules |
| The * rule | Denies anything no numbered rule matched; cannot be deleted | Same |
Source: docs.aws.amazon.com/vpc/latest/userguide/default-network-acl.html
NACL best practices
- Number rules in increments of 10 or 100, as AWS recommends, so you can insert rules later.
- Allow the return traffic. For every rule you add there must be a matching inbound or outbound rule for the response on the ephemeral ports.
- Pick the ephemeral range for your clients, or open 1024-65535 for public-facing subnets (see the table below).
- Put deny rules before broad allow rules. To block a malicious port inside the ephemeral range, give the deny a lower number than the rule that opens the range.
- Add IPv6 rules too. IPv4 and IPv6 traffic are evaluated separately, so IPv4 rules never apply to IPv6.
- Don't break load balancer health checks. A deny for all traffic from 0.0.0.0/0 or the subnet CIDR on backend subnets stops Elastic Load Balancing health checks.
- Troubleshoot with Reachability Analyzer, which can identify missing or misconfigured NACL rules.
Ephemeral port ranges
| Client | Ephemeral ports |
|---|---|
| Many Linux kernels, including Amazon Linux | 32768-61000 |
| Windows Server 2008 and later | 49152-65535 |
| Windows through Windows Server 2003 | 1025-5000 |
| Elastic Load Balancing | 1024-65535 |
| NAT gateway | 1024-65535 |
| AWS Lambda | 1024-65535 |
Source: docs.aws.amazon.com/vpc/latest/userguide/custom-network-acl.html
The client that starts the connection chooses the port. If a Windows 10 client calls a web server in your subnet, the NACL needs an outbound rule for ports 49152-65535.
Example rules for a public web subnet
| Rule | Port | Source | Action |
|---|---|---|---|
| 100 | 80 (HTTP) | 0.0.0.0/0 | Allow |
| 110 | 443 (HTTPS) | 0.0.0.0/0 | Allow |
| 120 | 22 (SSH) | Your network's range only | Allow |
| 140 | 32768-65535 (return traffic) | 0.0.0.0/0 | Allow |
| * | All | 0.0.0.0/0 | Deny |
Source: docs.aws.amazon.com/vpc/latest/userguide/custom-network-acl.html
What a NACL cannot block
NACLs do not filter traffic to and from Amazon DNS (the Route 53 Resolver), DHCP, EC2 instance metadata (IMDS), ECS task metadata endpoints, Windows license activation, the Amazon Time Sync Service and the reserved IPs of the default VPC router. To filter DNS queries, use Route 53 Resolver DNS Firewall.
Compare NACLs with security groups in the study topic security groups, NACLs and VPC endpoints, part of Domain 3: Infrastructure Security.
Frequently asked questions
Are AWS network ACLs stateful or stateless?
Stateless. Return traffic must be allowed by an explicit rule, unlike security groups, which are stateful.
In which order are NACL rules evaluated?
From the lowest rule number up; the first matching rule is applied and the rest are skipped.
What does a new custom NACL allow?
Nothing. It only has the * rules, which deny all traffic until you add rules.
Can a NACL block DNS or instance metadata?
No. NACLs do not filter Route 53 Resolver DNS, DHCP or instance metadata traffic. Use Route 53 Resolver DNS Firewall for DNS.
Sources
AWS updates its programs and documentation. Check the linked official pages for the latest details before you decide or pay.
Practice for your AWS exam
Free practice tests with instant explanations and spaced repetition. No sign-up.
Keep reading
- Security Specialty
AWS Firewall Manager vs WAF vs Network Firewall vs Shield
Four AWS firewall-style services, four different jobs. See what WAF, Shield, Network Firewall and Firewall Manager protect and when to use each.
3 min read - Security Specialty
AWS Security Specialty Study Plan: A 4-Week Roadmap
A week-by-week SCS-C03 study plan built from the domain weights: what to read, what to practice and how to finish with a timed test.
3 min read - Security Specialty
AWS Services in Scope for SCS-C03: Official List
Every AWS service on the Security Specialty exam, grouped by category, plus what is out of scope and the concepts AWS says to know.
2 min read