Acts at an Instance level and not at the subnet level.Network access control lists (NACLs)Р’В РІР‚вЂњ Act as a firewall for associated subnets, controlling both inbound and outbound traffic at the subnet level.Security groups РІР‚вЂњ Act as a virtual firewall for associated instances, controlling both inbound and outbound traffic at the instance level.In a VPC, both Security Groups and Network ACLs (NACLS) together help to build a layered network defence.Only one NACL can be associated with a single subnetР”В®valuates all Rules and finds the most permissive ruleР”В®valuates starting with the lowest numbered rule till a rule matches. Multiple SGs can be associated with an ec2 instance Key Differences between Security Group and NACL : Security GroupР”Р„ll inbound and outbound traffic allows by default.Р”Р„llow and deny both the rules can be added if some traffic is allowed in NACL Inbound Rule, the response Outbound traffic is not allowed by default unless specified in the Outbound Rules. Stateless: NACL does not maintain connections detail, which means it is stateless. Security Groups use Connection Tracking to keep track of connection details that flows in and out of an ec2 instance, this information includes РІР‚вЂњ IP address, Port number, and some other metadata. Security group achieves this by Connection Tracking. Now I visit a website on my ec2 instance, the response from the WebServer back to my ec2 instance will be allowed even you have set no traffic for an inbound rule. Stateful: Security Group is called a Stateful Firewall because SG maintains the state of a connection that means if an instance sends a request, the response traffic from outside is allowed back irrespective of the inbound rules and vice versa.Р”В®xample:- Let suppose In the security group you have blocked all the inbound traffic and allows all the outbound traffic. A security group is stateful while NACL is Stateless. Now the question is РІР‚СљWhat is the difference between Security Group and NACL?РІР‚СњР”Р‡irewall behavior is the major feature that will make security groups different from NACL. Allow/Deny: Specifies whether to allow or deny traffic.If a rule matches, it gets executed without checking for any other higher-numbered rules. Rule Number: Rules are evaluated starting with the lowest numbered rule.A default NACL looks like this : Default NACL Inbound Rules Default NACL Outbound Rules NACL Inbound and Outbound Rule Fields If we donРІР‚в„ўt associate a Subnet to a user-defined NACL then default NACL will be attached to that Subnet. In NACL you need to specify explicitly what to block in Inbound and Outbound Rules.Р”Р„ default NACL will be created when we create a new VPC and it allows ALL Inbound Traffic and Outbound Traffic. Everything both Inbound and Outbound traffic is allowed in default NACL. NACL is a stateless virtual firewall that works at the subnet level. Description: This is an optional field but recommends adding a description that helps the team to understand the purpose of the rule.Destination (Outbound rule): It could be single IP, anywhere (0.0.0.0/0) or CIDR range.Source (Inbound rule): It could be single IP, anywhere (0.0.0.0/0) or CIDR range.Port Range: You can specify a single port or a range of port e.g.Protocol: Same like type it could be autofill based on Type selection or can be specific custom.It also has a Custom Protocol option, which allows you to select other port range. Type: Type of traffic which can be SSH, SMTP, ICMP, etc.How newly added security group looks like in AWS: Default Inbound Rules For Security Group Default Outbound Rule For Security Group Security Group Inbound and Outbound Rule Fields:Р”В«oth the Inbound and Outbound rules have almost the same rule fields. security group rules are always permissive i.e You can not specify deny rules, you need to always define allow rules.However, you can remove this and set outbound rules as per your requirement. By default, all the outbound traffic is allowed in a newly created security group.To allow communication from another host to your EC2 instance, you need to add them to the inbound rules of a security group. There are no inbound rules for the newly created security group.For inbound and outbound traffic we can put separate rules.It acts like a virtual firewall that can be attached to the instance or instances.Р”В«elow are the basic attributes of security groups: Security Group is a stateful firewall for the EC2 instances to control inbound and outbound traffic. Basic Architecture of Security Group and NACL in AWS Basic Architecture of Security Group and NACL in AWS Security Group There is a common question in the interview is РІР‚СљWhat is the difference between Security Group and NACL?РІР‚Сњ So letРІР‚в„ўs discuss both topics in detail. Today we will discuss the most common topic of AWS i.e Security group and NACL.

Aws stateful vs stateless