Security Groups vs Network ACLs

Two firewalls on one private network, one guarding a single machine and one guarding a whole slice of the network, built from opposite ideas about what a firewall should remember.

Before you start. You need to know that a TCP connection opens with a SYN and gets an answering SYN-ACK back - TCP vs UDP, and the 3-way handshake covered that handshake. Data crosses a network in small numbered chunks called packets, each carrying a from-address and a to-address; you need “port” to mean nothing more than which door on that address a packet is headed for, the way One address, a thousand doors put it. Nothing else is assumed.

The idea in 30 seconds

A firewall that remembers each connection it let leave is stateful; one that judges every packet alone, with no memory, is stateless.
AWS’s security group is the 1994 stateful design, attached to one instance. Its network ACL is the older, 1988 stateless design, attached to a whole subnet.
A reply lands on an ephemeral port your machine’s operating system picked at random. A stateless wall cannot predict it, so it needs a standing rule for the whole range.
That is why a bad NACL rule fails as a silent hang, not a refusal: the reply is dropped at the subnet boundary and the sender just waits out its own timeout.
A NACL reads its rules in order, first match wins, so rule order matters. A security group is a pile of allows; adding one can only ever widen access.
The stateless design still wins the one job a security group cannot do at all: deny a range across a whole subnet at once.

Read the story · Skip to the numbers