NACLs

What is NACLs?

Network Access Control Lists (NACLs) are a stateless firewall feature in Amazon Virtual Private Cloud (VPC) that control traffic in and out of subnets. They are used to add an additional layer of security to your VPC by explicitly allowing or denying traffic based on source and destination IP addresses, protocols, and port numbers. Unlike security groups, NACLs act as the first line of defense at the subnet level. NACLs are stateless, meaning that they evaluate inbound and outbound traffic independently. This is in contrast to stateful firewalls, which remember previous connections. NACLs can be used to block specific IP addresses or ports, or to allow traffic only from specific networks. NACLs are evaluated in order, starting with the lowest rule number and proceeding until a rule matches the traffic. The last rule is an implicit deny.