Security groups versus network ACLs. What is the difference, and when would you use each?
Show the answer
Say this first
A security group is a stateful firewall on each network interface. It has allow rules only, all rules are evaluated together, and return traffic is allowed automatically. A network ACL is stateless and applies to the whole subnet. Its numbered rules are checked lowest first, the first match wins, it can allow or deny, and you must open return traffic yourself, usually ephemeral ports 1024 to 65535.
Go deeper
| Security group | Network ACL | |
|---|---|---|
| Attached to | ENI (instance, endpoint, load balancer) | Subnet |
| State | Stateful | Stateless |
| Rules | Allow only | Allow and deny |
| Evaluation | All rules, most permissive wins | By rule number, lowest first, first match |
| Sources | CIDR, prefix list, another security group | CIDR only |
| Default | New SG: no inbound, all outbound | Default NACL allows all; a new custom NACL denies all |
How I use them
- Security groups do the real work. Reference groups instead of addresses: the app SG allows port 8080 from the web SG, the DB SG allows 5432 from the app SG. Instances can be replaced or scaled and the rules still hold.
- NACLs are a coarse guard rail. Block a known bad range, or enforce "this subnet never talks to that subnet" as a second layer. Keep them simple, because every rule needs a matching return rule.
The return traffic trap
A NACL that allows inbound 443 must also allow outbound to the client's ephemeral ports, and a subnet whose instances make outbound calls needs inbound rules for the replies. Linux uses 32768 to 60999, Windows uses 49152 to 65535, and load balancers can use anything from 1024. Allowing 1024 to 65535 is the usual answer.
They will ask next
Can you block one IP address with a security group?
No. Security groups have no deny rule. Use a network ACL deny rule with a lower number than the allow rules, or AWS WAF for HTTP traffic.
What does the default security group allow?
Inbound from other members of the same default security group, and all outbound. Many teams remove its rules so nobody uses it by accident.
Does changing a security group rule cut existing connections?
Not always. Tracked connections can keep flowing after you remove the rule that allowed them, until they close or time out. A NACL change takes effect on the next packet because it has no state.
Traps
- Saying network ACLs are stateful, or that security groups support deny rules.
- Forgetting outbound ephemeral ports on a NACL, then blaming the application.