Network ACLs (NACL) - Control Traffic to Subnets

Now that you know what NACL is, you might be curious about how it actually works and why it’s crucial in AWS architecture. Join us in this blog as we discuss deeper into NACL’s functions and discover its vital role in securing your AWS environment. 

Table of Contents

• Understanding Network Access Control List (NACL) in AWS?
• Components of Network Access Control List (NACL)
• Types of Network ACL
  • Default Network ACL
  • Custom Network ACL
• Creating a Network ACL
• Network ACLs Vs. Security groups  – What is the Difference?
• Conclusion

Unlock the power of AWS VPC with our step-by-step tutorial – Watch now!

Understanding Network Access Control List (NACL) in AWS?

A Network Access Control List (NACL) acts like a virtual firewall for subnets, regulating both incoming and outgoing traffic within them. When you create a Virtual Private Cloud (VPC), it automatically associates a default NACL that permits all inbound and outbound traffic.

NACLs are a powerful tool that can be used to improve the security of your AWS VPC. However, it is important to note that NACLs are just one component of a comprehensive security strategy. To protect your AWS resources, you should also use other security features, such as security groups, IAM roles, and WAF rules.

Components of Network Access Control List (NACL)

Now that we understand the basics, let’s explore the key components that make up Network Access Control Lists (NACLs) in AWS.

1. Rule Number: Each rule is assigned a unique number, and they are evaluated in ascending order. Once a rule matches incoming or outgoing traffic, it is immediately applied, even if higher-numbered rules contradict it.
2. Protocol: You have the flexibility to define any standard protocol, such as HTTP, HTTPS, ICMP, SSH, etc., when configuring rules for the ACL.
3. Inbound Rules: Inbound rules determine the source of incoming traffic and the destination port it is allowed to reach.
4. Outbound Rules: Outbound rules specify the destination for outgoing traffic and the destination port it can access.

Types of Network ACL

With a clear understanding of NACL components, let’s now explore the various types of Network Access Control Lists (NACLs) available in AWS.

• Default Network ACL
• Custom Network ACL

Default Network ACL

The default network ACL permits unrestricted traffic to enter or exit the associated subnet. Additionally, every network ACL includes a rule marked with an asterisk rule number, responsible for denying traffic that doesn’t match any numbered rules. This particular rule is immutable and cannot be altered or deleted.

In this example, the above table is a default Network ACL table, which is associated with a subnet.

• Rule 200 allows incoming HTTP traffic (port 80) from the source IP range 10.0.0.0/24.
• Rule 201 allows incoming HTTPS traffic (port 443) from the same source IP range 10.0.0.0/24.
• Rule 202 permits SSH traffic (port 22) from the source IP range 192.168.1.0/24.
• Rule 203 allows RDP traffic (port 3389) from the same source IP range 192.168.1.0/24.
• The wildcard rule (*) at the bottom denies all other incoming and outgoing traffic, providing a default security posture that allows only specific types of traffic from specified source IP ranges while denying all other traffic.

Custom Network ACL

A Custom Network ACL is a user-defined access control list that lets you customize your network security policies. It’s sometimes called a Security Group in certain cloud environments.

In this example:

• Rule 100 allows incoming HTTP traffic (port 80) from the source IP range 10.0.0.0/24.
• Rule 101 permits incoming HTTPS traffic (port 443) from the same source IP range 10.0.0.0/24.
• Rule 102 allows SSH traffic (port 22) from the source IP range 192.168.1.0/24.
• Rule 103 permits RDP traffic (port 3389) from the same source IP range 192.168.1.0/24.
• The wildcard rule (*) at the end serves as a catch-all, denying all incoming and outgoing traffic, providing a default security posture that allows only specific types of traffic from specified source IP ranges while blocking everything else. This custom Network ACL offers fine-grained control over traffic, allowing or denying access based on defined rules.

Creating a Network ACL

• Log in to the AWS Management Console.
• Navigate to the VPC service located under Networking and Content Delivery.

• Select “Your VPCs” on the left-hand side of the console. In previous discussions, we have established a custom VPC named “Intellipaat.”

• On the left-hand side of the console, click on “Network ACLs.”

• Choose “Create Network ACL.”

• Provide the necessary information to create a Network ACL.

The screen below confirms the successful creation of the Network ACL.

Network ACLs Vs. Security groups  – What is the Difference?

To start, let’s learn what Security groups are in AWS before we discuss the differences between nacl and security group. Security groups are an important part of AWS network security, serving as virtual firewalls for your Amazon Elastic Compute Cloud (EC2) instances. Here are the following differences given below:

Conclusion

Network Access Control Lists (NACLs) are like invisible yet indispensable gatekeepers of your AWS cloud infrastructure. You can use these versatile components to control network traffic in your virtual networks carefully. This fine-grained security layer allows only authorized communication to flow in and out. AWS users can use default NACLs for basic protection and custom NACLs for more specific security policies. This gives them the ability to create strong defenses against potential threats.

NACLs are important for AWS network security. They work with security groups, which handle different security aspects. NACLs control traffic at the subnet level, using IP addresses and rules. Security groups manage access at the instance level, based on group memberships. These tools work together to defend against cyber threats. AWS users can feel confident navigating the cloud securely and protecting their assets.

Frequently Asked Questions (FAQs)