Lesson 08 — Network ACLs (NACLs)

Learning Path

☁️ Phase 2 – AWS Cloud Security

📘 Module 04 – Amazon VPC & Network Security

🎯 Lesson Objective

By the end of this lesson, you will be able to:

Understand what Network ACLs (NACLs) are.
Differentiate Security Groups and NACLs.
Configure inbound and outbound NACL rules.
Associate NACLs with subnets.
Build enterprise subnet security.
Configure NACLs using AWS Console and AWS CLI.
Troubleshoot network access issues.

📚 Lesson Information

Estimated Time: 2 Hours

Difficulty: Intermediate

Prerequisites: Lesson 07 – Security Groups

Hands-on Lab: Yes

💼 Business Value

Imagine a corporate office building.

Before someone reaches an employee’s desk, there are two security checkpoints.

First:

A security guard at the building entrance.

Second:

Security outside each office.

AWS networking works exactly the same way.

Building Entrance

↓

Network ACL

↓

Office Door

↓

Security Group

↓

Server

Even if someone passes the first checkpoint, they must still pass the second.

This layered security approach is called Defense in Depth.

🏢 CloudNova Scenario

CloudNova hosts its Learning Platform in AWS.

The security team wants additional protection beyond Security Groups.

Requirements:

Allow customers to access the website.
Allow application servers to communicate internally.
Block unnecessary traffic before it reaches EC2 instances.
Prevent accidental exposure of production subnets.

The solution is to implement Network ACLs.

🌍 What is a Network ACL?

A Network Access Control List (NACL) is a stateless firewall that controls traffic entering and leaving an entire subnet.

Unlike Security Groups, NACLs operate at the subnet level.

Every subnet in a VPC must be associated with one NACL.

🏗 Where NACLs Work

Internet

↓

Internet Gateway

↓

Public Subnet

↓

Network ACL

↓

EC2 Instance

↓

Security Group

↓

Application

Traffic must pass through:

Network ACL
Security Group

before reaching the application.

Security Groups vs NACLs

Security Groups	Network ACLs
Instance Level	Subnet Level
Stateful	Stateless
Allow Rules Only	Allow & Deny Rules
Automatically Allows Return Traffic	Return Traffic Must Be Explicitly Allowed
Applied to EC2, ALB, RDS etc.	Applied to Subnets

🔄 Stateful vs Stateless

Security Groups

Laptop

↓

HTTPS

↓

EC2

↓

Response

↓

Automatically Allowed

No additional outbound rule required.

Network ACL

Laptop

↓

HTTPS

↓

NACL

↓

EC2

↓

Response

↓

Must Match Outbound Rule

Every direction requires its own rule.

📋 NACL Rule Structure

Every rule contains:

Rule Number
Protocol
Port Range
Source/Destination
Allow or Deny

Example

Rule	Protocol	Port	Source	Action
100	TCP	443	0.0.0.0/0	ALLOW
110	TCP	80	0.0.0.0/0	ALLOW
120	TCP	22	Corporate IP	ALLOW
*	All	All	All	DENY

Rules are processed in ascending order.

🏗 CloudNova Enterprise Architecture

Internet

↓

Internet Gateway

↓

Public Subnet

↓

Public NACL

↓

Application Load Balancer

↓

Private App Subnet

↓

Application NACL

↓

EC2

↓

Private DB Subnet

↓

Database NACL

↓

Amazon RDS

Each subnet has its own NACL tailored to its purpose.

Enterprise NACL Strategy

Subnet	NACL
Public	Public-NACL
Private App	App-NACL
Private Database	DB-NACL

This approach improves security and simplifies management.

🛠 Lab 01 — View Existing Network ACLs

Open

AWS Console

↓

VPC

↓

Network ACLs

Review:

NACL ID
VPC
Associated Subnets
Inbound Rules
Outbound Rules

Notice the Default NACL created automatically with every VPC.

🛠 Lab 02 — Create Public Network ACL

Navigate to

Network ACLs

↓

Create Network ACL

Configure

Setting	Value
Name	Public-NACL
VPC	CloudNova-VPC

Click

Create Network ACL

Associate Public Subnet

Open

Subnet Associations

↓

Edit

Select

Public-Subnet-A

Save.

Configure Inbound Rules

Select

Inbound Rules

↓

Edit

Add

Rule	Protocol	Port	Source	Action
100	TCP	80	0.0.0.0/0	ALLOW
110	TCP	443	0.0.0.0/0	ALLOW
120	TCP	1024-65535	0.0.0.0/0	ALLOW
*	All	All	All	DENY

Click

Save Changes

Configure Outbound Rules

Rule	Protocol	Port	Destination	Action
100	TCP	80	0.0.0.0/0	ALLOW
110	TCP	443	0.0.0.0/0	ALLOW
120	TCP	1024-65535	0.0.0.0/0	ALLOW
*	All	All	All	DENY

🛠 Lab 03 — Create Private Application NACL

Create

App-NACL

Associate

Private-App-A

Inbound Rules

Rule	Protocol	Port	Source	Action
100	TCP	80	Public Subnet CIDR	ALLOW
110	TCP	1024-65535	0.0.0.0/0	ALLOW
*	All	All	All	DENY

Outbound Rules

Rule	Protocol	Port	Destination	Action
100	TCP	443	0.0.0.0/0	ALLOW
110	TCP	1024-65535	0.0.0.0/0	ALLOW
*	All	All	All	DENY

🛠 Lab 04 — Create Database NACL

Create

DB-NACL

Associate

Private-DB-A

Inbound Rules

Rule	Protocol	Port	Source	Action
100	TCP	3306	Private App Subnet CIDR	ALLOW
110	TCP	1024-65535	Private App Subnet CIDR	ALLOW
*	All	All	All	DENY

Outbound Rules

Rule	Protocol	Port	Destination	Action
100	TCP	1024-65535	Private App Subnet CIDR	ALLOW
*	All	All	All	DENY

💻 AWS CLI Lab

List NACLs

aws ec2 describe-network-acls

Create Network ACL

aws ec2 create-network-acl \
    --vpc-id vpc-xxxxxxxx

Tag Network ACL

aws ec2 create-tags \
    --resources acl-xxxxxxxx \
    --tags Key=Name,Value=Public-NACL

Associate Network ACL

aws ec2 replace-network-acl-association \
    --association-id aclassoc-xxxxxxxx \
    --network-acl-id acl-xxxxxxxx

Create Inbound Rule

aws ec2 create-network-acl-entry \
    --network-acl-id acl-xxxxxxxx \
    --ingress \
    --rule-number 100 \
    --protocol tcp \
    --port-range From=80,To=80 \
    --cidr-block 0.0.0.0/0 \
    --rule-action allow

Create HTTPS Rule

aws ec2 create-network-acl-entry \
    --network-acl-id acl-xxxxxxxx \
    --ingress \
    --rule-number 110 \
    --protocol tcp \
    --port-range From=443,To=443 \
    --cidr-block 0.0.0.0/0 \
    --rule-action allow

View NACLs

aws ec2 describe-network-acls

✅ Verification

Verify

Public NACL

HTTP

HTTPS

Ephemeral Ports

↓

Allowed

Private App NACL

HTTP from Public Subnet

↓

Allowed

Database NACL

MySQL from App Subnet

↓

Allowed

Confirm each subnet is associated with the correct NACL.

🔍 Troubleshooting

Problem

Website unavailable.

Verify

Public NACL allows ports 80 and 443.
Public Route Table.
Internet Gateway.

Problem

Application cannot reach database.

Check

Database NACL.
Rule Number.
Port 3306.
Return traffic rules.

Problem

Connections timeout.

Possible causes

Missing ephemeral ports.
Incorrect rule order.
Wrong subnet association.

Problem

Traffic blocked unexpectedly.

Remember:

Network ACLs process rules from the lowest rule number to the highest.

The first matching rule is applied.

🏢 Enterprise Notes

CloudNova standards:

Use separate NACLs for Public, Application and Database subnets.
Use Security Groups as the primary firewall.
Use NACLs for subnet-level protection.
Document every custom rule.
Review NACLs quarterly.
Follow the Principle of Least Privilege.
Test NACL changes in non-production environments first.

🚫 Common Mistakes

❌ Forgetting outbound rules.

❌ Forgetting ephemeral ports.

❌ Applying one NACL to every subnet.

❌ Creating conflicting rule numbers.

❌ Depending solely on NACLs for security.

❌ Not documenting custom rules.

🧪 DIY Challenge

Using your AWS account:

Create:

Public-NACL
App-NACL
DB-NACL

Associate:

Public-Subnet-A → Public-NACL
Private-App-A → App-NACL
Private-DB-A → DB-NACL

Configure:

Public subnet for HTTP and HTTPS.
Application subnet for application traffic.
Database subnet for MySQL only.
Include ephemeral port rules where required.

Verify:

Correct subnet associations.
Rules applied correctly.
Web application accessible.
Database accessible only from the application subnet.

Take screenshots of:

Network ACLs
Inbound Rules
Outbound Rules
Subnet Associations
AWS CLI output (describe-network-acls)

📊 Knowledge Check

What is a Network ACL?
At which level does a NACL operate?
Is a NACL stateful or stateless?
What is the difference between Security Groups and NACLs?
Why are ephemeral ports required in NACLs?
Which command lists Network ACLs?
Can a NACL contain DENY rules?
How are NACL rules processed?
Why should production databases have dedicated NACLs?
Why do enterprises use both Security Groups and NACLs together?

💡 Key Takeaways

After completing this lesson, you should understand:

Network ACLs provide subnet-level protection for Amazon VPCs.
Unlike Security Groups, NACLs are stateless and require explicit rules for both inbound and outbound traffic.
NACLs support both ALLOW and DENY rules, making them useful for implementing coarse-grained network controls.
Combining Network ACLs with Security Groups provides a layered Defense in Depth security model.
Properly designed NACLs help protect enterprise workloads while maintaining secure and predictable network communication.

🚀 Next Lesson

➡️ Lesson 09 — VPC Endpoints & AWS PrivateLink