A network access control list (ACL) is an ordered set of allow and deny rules that filters traffic entering or leaving a network segment. In cloud networks it usually applies at the subnet level, is stateless, and is checked in rule number order until one matches.
How does a network ACL work in a cloud network?
Amazon's VPC documentation gives a concrete model. A network ACL allows or denies specific inbound or outbound traffic at the subnet level. Each subnet must be associated with one network ACL, and if you do not choose one, the subnet gets the default ACL. A single ACL can be associated with many subnets, but a subnet can have only one ACL at a time. Rules are evaluated when traffic enters or leaves the subnet, not as it moves between hosts inside it.
Other platforms and physical routers use similar ideas with different details, so treat the following as one well documented example.
How are rules evaluated?
An ACL has inbound rules and outbound rules. Each rule can allow or deny. Each has a number from 1 to 32766, and rules are evaluated starting with the lowest number. When traffic matches a rule, that rule applies and no later rule is checked. The documentation recommends numbering in increments of 10 or 100 so you can insert rules later.
Order is the whole game. A broad deny at rule 100 placed before a narrow allow at rule 200 means the allow never applies.
What does stateless mean?
The documentation states that these ACLs are stateless: information about previously sent or received traffic is not saved. If a rule allows specific inbound traffic to the subnet, the responses are not automatically allowed. You must write an outbound rule for them. That contrasts with security groups, which the documentation says are stateful.
This is the most common source of confusion. A web server that receives requests on port 443 must also be allowed to send replies, and replies go to a client chosen port, so the return rule has to cover the range clients use.
When do you use an ACL instead of a security group?
The documentation describes custom network ACLs as an additional layer of security for a VPC, with rules similar to security group rules. Security groups attach to instances and are stateful. ACLs attach to subnets and are stateless, and they can deny explicitly. A common pattern is to use security groups for per-workload allow rules and an ACL as a coarse subnet guardrail, for instance to block a known bad address range for everything in the subnet. Do not duplicate the same policy in both, because two places to change means mismatches.
A constructed example
A team has a public subnet for load balancers and a private subnet for databases. They write an ACL for the database subnet: rule 100 allows inbound TCP on the database port from the application subnet range, rule 110 allows outbound TCP on the return port range to that same range, and rule 900 denies everything else. A later change adds a reporting server in a third subnet. It cannot connect, and the team spends an hour before noticing no rule allows that range. The fix is a new rule at 120, which is why they numbered in tens.
How to check or apply this
- List your subnets and the ACL associated with each.
- For every ACL, read the rules in number order and note the first match for the traffic you care about.
- Check that each inbound allow has a matching outbound rule for the return traffic.
- Number rules in steps of 10 or 100 to leave room.
- Keep ACLs coarse and let security groups carry per-workload rules.
- Avoid broad allow rules that cover all ports or all addresses unless you can name the reason.
- Review ACL changes like code: use version control and an approval step.
- Test with real connections after changing rules, from both sides.
Quick check
Why did my allowed traffic still fail?
Possibly a lower numbered deny rule matched first, or the return traffic is not allowed because ACLs are stateless. Check rule order and the outbound rules.
Is a network ACL a firewall?
It performs packet filtering, one function of a firewall. NIST describes firewalls more broadly, with stateful inspection and application-level features that a simple ACL does not have.
Sources
- AWS: Control subnet traffic with network access control lists
- NIST SP 800-41 Rev. 1: Guidelines on Firewalls and Firewall Policy
Last reviewed: 18 October 2026.
