Stateless behavior of NACLs in AWS - Step-by-Step Execution

Process Flow - Stateless behavior of NACLs

Packet arrives at subnet

↓

Check inbound NACL rules

↓

Drop packet

↓

Instance processes packet

↓

Response packet sent

↓

Check outbound NACL rules

↓

Drop packet

A packet entering a subnet is checked against inbound NACL rules; if allowed, it reaches the instance. The response packet is then checked against outbound NACL rules before leaving, showing stateless checks on both directions.

Execution Sample

AWS

Inbound NACL: Allow TCP port 80
Outbound NACL: Allow TCP port 80
Packet: TCP request to port 80
Response: TCP reply from port 80

This setup shows a TCP request allowed inbound and its response allowed outbound by separate NACL rules.

Process Table

Step	Packet Direction	NACL Rule Checked	Rule Result	Action Taken
1	Inbound	Allow TCP port 80	Match	Packet forwarded to instance
2	Inbound	Other rules	No match	No action (default deny)
3	Outbound	Allow TCP port 80	Match	Response packet sent out
4	Outbound	Other rules	No match	No action (default deny)
5	Inbound	Packet to port 22	No match	Packet dropped
6	Outbound	Response from port 22	No match	Packet dropped

💡 Packets dropped if no matching allow rule found in respective inbound or outbound NACL checks

Status Tracker

Variable	Start	After Step 1	After Step 3	After Step 5
Packet Direction	Inbound	Inbound	Outbound	Inbound
Packet Port	80	80	80	22
NACL Rule Match	None	Allow TCP 80	Allow TCP 80	No match
Packet Status	Pending	Forwarded	Sent out	Dropped

Key Moments - 2 Insights

Why does the response packet need its own outbound NACL rule if the inbound request was allowed?

Because NACLs are stateless, the response packet is checked separately against outbound rules (see execution_table steps 3 and 5). Allowing inbound does not automatically allow outbound.

What happens if there is no matching rule for a packet in NACL?

The packet is dropped by default as shown in execution_table steps 2, 4, and 5 where no match leads to drop.

Visual Quiz - 3 Questions

Look at the execution table, what is the packet status after step 1?

A Dropped

B Forwarded

C Sent out

D Pending

💡 Hint

Check the 'Packet Status' column after step 1 in the execution_table.

At which step does the packet get dropped due to no matching inbound rule?

A Step 5

B Step 1

C Step 3

D Step 6

💡 Hint

Look for 'Packet dropped' with 'Inbound' direction and 'No match' in NACL Rule Checked.

If the outbound NACL allowed all ports, how would step 6 change?

A Packet would be forwarded to instance

B Packet would be dropped

C Packet would be sent out

D No change

💡 Hint

Refer to step 6 where no match causes drop; allowing all ports outbound would allow sending out.

Concept Snapshot

NACLs check inbound and outbound traffic separately.
They are stateless: allow rules must exist for both directions.
No matching rule means packet is dropped by default.
Inbound rules control incoming packets; outbound rules control outgoing packets.
This ensures explicit control over traffic flow in both directions.

Full Transcript

Network Access Control Lists (NACLs) in AWS are stateless. This means each packet is checked independently when it enters and leaves a subnet. When a packet arrives inbound, it is checked against inbound NACL rules. If allowed, it reaches the instance. When the instance sends a response, that packet is checked against outbound NACL rules. Both directions require explicit allow rules. If no rule matches, the packet is dropped. This behavior ensures tight control over traffic flow but requires rules for both inbound and outbound directions.

Practice

1. What does it mean that Network ACLs (NACLs) are stateless in AWS?

easy

A. NACLs remember the state of connections to allow return traffic automatically

B. Each packet is checked independently without remembering previous packets

C. NACLs only filter traffic based on IP addresses, not ports

D. NACLs automatically block all inbound traffic by default

Solution

1. Step 1: Understand the meaning of stateless

   Stateless means the system does not keep track of previous packets or connection states.

2. Step 2: Apply this to NACLs

   NACLs evaluate each packet on its own, without remembering if it is part of an existing connection.

3. Final Answer:

   Each packet is checked independently without remembering previous packets -> Option B

4. Quick Check:

   Stateless means no memory of past packets = A [OK]

Hint: Stateless means no memory of past packets, check each separately [OK]

Common Mistakes:

• Thinking NACLs remember connection states like security groups
• Assuming NACLs allow return traffic automatically
• Confusing stateless with blocking all traffic by default

2. Which of the following is the correct way to allow inbound HTTP traffic on port 80 using a NACL rule?

easy

A. Allow inbound traffic on port 80 with rule number 100, protocol TCP, action ALLOW

B. Allow inbound traffic on port 22 with rule number 100, protocol TCP, action ALLOW

C. Allow outbound traffic on port 80 with rule number 100, protocol TCP, action DENY

D. Allow inbound traffic on port 443 with rule number 100, protocol UDP, action ALLOW

Solution

1. Step 1: Identify the correct port and protocol for HTTP

   HTTP uses TCP protocol on port 80.

2. Step 2: Confirm the rule direction and action

   To allow inbound HTTP traffic, the rule must be inbound with action ALLOW.

3. Final Answer:

   Allow inbound traffic on port 80 with rule number 100, protocol TCP, action ALLOW -> Option A

4. Quick Check:

   Inbound TCP port 80 ALLOW = D [OK]

Hint: HTTP uses TCP port 80 inbound ALLOW rule [OK]

Common Mistakes:

• Using wrong port number or protocol
• Setting rule direction incorrectly
• Using DENY action instead of ALLOW

3. Consider a NACL with the following rules:
Inbound Rule 100: ALLOW TCP port 80
Outbound Rule 100: DENY all traffic
What will happen when an instance in the subnet tries to send a response to an HTTP request?

medium

A. The response will be allowed because inbound is allowed

B. The response will be allowed because NACLs are stateful

C. The response will be blocked because outbound is denied

D. The response will be blocked because inbound denies it

Solution

1. Step 1: Analyze inbound rule

   Inbound HTTP traffic on port 80 is allowed, so requests can reach the instance.

2. Step 2: Analyze outbound rule

   Outbound rule denies all traffic, so responses from the instance are blocked.

3. Final Answer:

   The response will be blocked because outbound is denied -> Option C

4. Quick Check:

   Outbound DENY blocks response despite inbound ALLOW = B [OK]

Hint: Both inbound and outbound must allow traffic for two-way flow [OK]

Common Mistakes:

• Assuming NACLs are stateful and allow return traffic automatically
• Ignoring outbound rules when troubleshooting
• Confusing inbound and outbound directions

4. You configured a NACL to allow inbound SSH (port 22) and outbound HTTP (port 80) traffic. However, SSH connections fail. What is the most likely cause?

medium

A. Outbound SSH traffic is not allowed in the NACL

B. Inbound HTTP traffic is not allowed in the NACL

C. NACLs are stateful and do not require outbound rules

D. Security groups block SSH traffic

Solution

1. Step 1: Review NACL rules for SSH

   Inbound SSH (port 22) is allowed, but outbound SSH must also be allowed for return traffic.

2. Step 2: Understand stateless nature of NACLs

   NACLs do not remember connection state, so both inbound and outbound rules must permit traffic.

3. Final Answer:

   Outbound SSH traffic is not allowed in the NACL -> Option A

4. Quick Check:

   Both directions must allow SSH for connection success = C [OK]

Hint: Allow both inbound and outbound for SSH due to stateless NACLs [OK]

Common Mistakes:

• Assuming NACLs are stateful and outbound rules are unnecessary
• Blaming security groups without checking NACLs
• Ignoring outbound rules for return traffic

5. You want to allow a subnet to communicate with the internet using HTTP and HTTPS. Which NACL configuration correctly supports this stateless behavior?

hard

A. Allow all inbound and outbound traffic to simplify rules

B. Allow inbound TCP ports 80 and 443, allow outbound ephemeral ports 1024-65535

C. Allow inbound and outbound TCP ports 80 and 443 only

D. Allow inbound ephemeral ports 1024-65535, allow outbound TCP ports 80 and 443

Solution

1. Step 1: Understand HTTP/HTTPS traffic flow

   Clients initiate outbound connections to ports 80 and 443; responses come back on ephemeral ports (1024-65535).

2. Step 2: Configure NACL rules for stateless behavior

   Outbound rules must allow TCP ports 80 and 443; inbound rules must allow ephemeral ports for return traffic.

3. Final Answer:

   Allow inbound ephemeral ports 1024-65535, allow outbound TCP ports 80 and 443 -> Option D

4. Quick Check:

   Outbound to 80/443, inbound ephemeral ports for response = A [OK]

Hint: Allow outbound ports 80/443 and inbound ephemeral ports for return [OK]

Common Mistakes:

• Allowing inbound ports 80/443 instead of ephemeral ports
• Not allowing ephemeral ports inbound blocks responses
• Allowing all traffic unnecessarily