CODEWITHSUNDEEP
amazon-web-servicesamazon-vpc
user829174
user829174

Reputation: 6362

Amazon VPC NACL default rules evaluation order

With my understanding, NACL (Network Access Control List) is the subnet firewall.

I'm trying to understand what are the defaults when creating a NACL:

So, bottom line, is all allowed or denied? I know that according to AWS best practices, all access should be disabled by default.

Rules

Upvotes: 10

Views: 8339

Answers (1)

John Rotenstein
John Rotenstein

Reputation: 269490

The rules are evaluated in number order.

As soon as the traffic matches the rule, the Allow/Deny is applied and evaluation ends.

Therefore, the default rule that you show above Allows all traffic. Nothing falls through to the default rule.

This numbered logic is handy for something like this, that denies ICMP traffic, then allows everything else:

NACL rules

Here's one that uses the default rule to only allow HTTPS:

NACL rule

Upvotes: 16

Related Questions