Lecture 13: VPC Firewall - Network Access Control List (NACL)
- 课程：[NEW] AWS Certified Advanced Networking Specialty 2026
- 视频时长：12:10
- 来源：Udemy Lecture 24112448
- Slide 数量：6
- 画面切换：约 01:33、05:30、07:23、08:34、09:54
扫描说明
按页面英文 transcript 的 195 个时间点逐一定位并检查视频画面，并对高差异画面逐项复核。相同幻灯片中的架构元素、规则和标注逐步出现均视为动画构建；两段独立白板推导分别单列为小节。
Transcript 来自 Udemy 页面自带的英文自动字幕，没有使用 ASR。下面保留页面原文，包括其中的语法或识别错误。
1. Network Access Control List (NACL)
时间范围：00:00–01:33
总结 / Summary
中文
网络访问控制列表（Network Access Control List, NACL）是作用于子网级别（subnet level）的 VPC 防火墙，其规则影响进出该子网的全部资源流量。与状态性（stateful）的安全组（Security Group）不同，NACL 是无状态的（stateless）：请求与返回流量必须分别由入站规则（inbound rule）和出站规则（outbound rule）允许，否则连接会被中断。
English
A Network Access Control List (NACL) is a subnet-level VPC firewall whose rules affect traffic for every resource in the subnet. Unlike a stateful Security Group, a NACL is stateless: request and return traffic must be allowed independently by inbound and outbound rules, or the connection fails.
Transcript
00:00 Hello and welcome to this lecture on network Access Control list.
00:03 So in the last lecture we saw how security Group works.
00:05 As you know they work at EC2 instance level.
00:08 Now let's look at the other firewall in VPC that is network ACL.
00:12 So as I said network ACL works at subnet level.
00:15 That means whatever rules you add to the network ACL, they will be applied to all the, uh, EC2 instances,
00:21 right.
00:22 Whatever traffic is coming in to the subnet.
00:24 So while you compare network ACL with uh security group, there are subtle differences.
00:29 And you need to know this uh, very clearly for your exam.
00:32 So let's see what network ACL looks like.
00:35 And as and when we progress uh, into the course we will also try to demonstrate how network ACL works.
00:42 So first thing network ACL works at subnet level.
00:45 As you know it applies to all the traffic which goes inside your subnet irrespective of uh which EC2
00:51 instance is going to.
00:53 They are stateless.
00:54 Now, if you remember from the last lecture we said like security groups are stateful, which means,
01:01 uh, whatever traffic is coming into your security group from a given IP, the return traffic goes without
01:06 having the outbound rule into the security group.
01:09 Right.
01:10 And the other way around, if traffic going out, uh, the return traffic will come back without having
01:14 the inbound rule.
01:15 That's a statefulness of security group.
01:18 But we are saying now the network ACL are not stateful, they are stateless, which has to be then handled
01:25 properly.
01:25 If you misconfigure network ACL, then your traffic may not flow.
01:30 So let's look at what this statelessness means.
2. Stateless Return Traffic and Ephemeral Ports
时间范围：01:33–05:30
总结 / Summary
中文
白板示例说明客户端访问 EC2 Web 服务器的端口 80 时，客户端连接使用的是临时端口（ephemeral port），而不是本地端口 80。由于 NACL 无状态（stateless），除了允许入站的 TCP/80，还必须在出站方向允许客户端临时端口范围（ephemeral port range，课程示例为 32768–65535）。这也是 NACL 排错时经常遗漏的返回路径规则。
English
The whiteboard example shows that when a client connects to an EC2 web server on port 80, the client side uses an ephemeral port rather than local port 80. Because a NACL is stateless, TCP/80 must be allowed inbound and the client's ephemeral port range (32768–65535 in the lecture example) must be allowed outbound. Missing this return-path rule is a common NACL troubleshooting issue.
Transcript
01:32 So again a similar example.
01:35 We have an EC2 instance.
01:37 And we have web server which is running on port 80.
01:41 And now as we are talking about network ACL we will talk about the subnet.
01:45 So we have this EC2 instance in say a public subnet.
01:49 And then there is one network ACL sitting here.
01:53 Uh now by default whatever network ACL comes in it allows the all inbound and outbound traffic.
01:59 But now we are talking about, say custom network ACL.
02:01 You went and modified this network ACL.
02:03 And then here is a client which has some IP address.
02:07 Let's take an example 1.2.3.4 for simplicity.
02:10 Now again the question is what inbound and outbound rule you need to have in this network ACL.
02:20 Right.
02:21 So of course, the inbound rule, uh, is similar to what EC2 would have, right?
02:25 You need to open port 80, uh from this IP address and then the traffic can go in.
02:32 So that means I would have similar rule port 80.
02:34 Open it for one, two, three, four.
02:37 Now the question comes what about the return traffic.
02:41 It will hit the EC2 instance and now the traffic will go back from the EC2 instance.
02:45 It will hit network ACL and it will check.
02:48 Is there a outbound rule.
02:49 Now this is required because network ACL is a stateless.
02:52 So if you see currently there is no outbound rule.
02:55 That means traffic won't go back to this EC2 instance.
02:59 Right?
02:59 That means you also need to have the outbound rule here.
03:03 Now the question is to which port this traffic will go back.
03:07 Now, uh, just bear with me.
03:09 I'll explain this, but imagine another case where there is just one EC2 instance and it is trying to
03:14 reach to the outside world, say w w w.
03:18 Now in that case, clearly it's an outbound traffic and in the network ACL the rule will be I.
03:23 This EC2 instance should be able to reach to internet on port 80 of the internet server.
03:28 So this will be the outbound rule for that kind of outbound traffic.
03:33 But in our case it's not really a traffic which is originated on EC2.
03:38 This is a traffic, uh, which came from this machine.
03:42 And now the traffic is going back.
03:44 It's a return traffic.
03:45 Now, one thing to understand is that we can't really have if you add just this rule port 80 and the
03:51 traffic is 1.3.1.2.3.4, it won't still work.
03:57 Can you guess why this is?
03:59 Because when my machine.
04:03 Or originates the traffic to the web server.
04:07 It does not use port 80.
04:09 Here it uses the ephemeral port range to establish this connection to port 80.
04:15 And if you know, ephemeral ports are typically in this range three, two, seven, six, 8 to 6 five,
04:23 five, three, five.
04:25 So that means randomly one port is picked from here.
04:28 Let's take an example say 3 to 800.
04:34 So this port is three two 800 and this port is 80.
04:37 That's where the connection is established.
04:39 That means if the traffic has to go back, you have to actually, uh, send the traffic back to this
04:46 port, not the port 80 of this originating machine.
04:50 That means you don't need to have port 80, but you need to specify the whole range of this ephemeral
04:56 port, because you are not sure which port will be used, uh, when the new connection is made.
05:01 So you need to actually add this rule port range this and the IP is this.
05:06 Then the outbound traffic will go back to the machine and your connection is closed now.
05:11 So this is how the network ACL works.
05:14 And if you miss this rule then your traffic won't go back.
05:19 So it is very essential that you know how to troubleshoot this kind of issues.
05:23 So that's called a statelessness of your network ACL.
05:27 I hope that is clear.
3. NACL Rule Characteristics
时间范围：05:30–07:23
总结 / Summary
中文
NACL 同时支持允许规则（allow rules）和拒绝规则（deny rules），并按照规则编号（rule number）从小到大进行首次匹配（first match）。一旦某条规则匹配，就立即执行允许或拒绝动作，不再检查后续规则。默认 NACL（default NACL）允许全部入站和出站流量，而自定义 NACL（custom NACL）需要明确配置所需规则。
English
A NACL supports both allow and deny rules and evaluates them by ascending rule number using first-match behavior. Once a rule matches, its action is applied and later rules are not evaluated. The default NACL allows all inbound and outbound traffic, whereas a custom NACL must be configured explicitly for the required flows.
Transcript
05:29 So let's go back.
05:31 Um next is it contains both allow and deny rules like in the security group.
05:37 If you saw we could just add the rule.
05:39 And which means a given IP is now allowed.
05:42 Right.
05:43 So in this EC2 instance, whatever IP address or machine one two, three we could just add the allow
05:50 rules.
05:51 We can't say stop the traffic from this machine using the deny rules in security group.
05:56 But in network ACL you can do that.
05:57 You can say this IP 1234I want to deny the traffic two right.
06:03 And then traffic won't flow.
06:04 That means it allows both this type of the rules.
06:07 Rules are evaluated in the order of the rule number.
06:10 So in security group uh, typically what happens uh, it evaluates all the rules.
06:14 And if it uh, somewhere if you have the allow rules, of course it will.
06:19 Irrespective of the, uh, sequence of the rule, it will allow the traffic, if anywhere, it finds
06:25 that.
06:25 But in network ACL, it will go by the rule numbers.
06:28 So maybe it'll start at 100 and then one zero, 1102 kind of thing.
06:32 If, uh 100 says the traffic is denied, it won't go next and it won't check for the same source IP
06:39 address whether it's allowed or not.
06:41 So which which your rules, uh, matches first, it will take into the effect uh, default network ACL
06:47 allows all inbound and outbound traffic.
06:49 As I said earlier, uh, if you are launching your EC2 for the first time, you won't even realize that
06:55 there is something called network ACL.
06:56 But in security Group, you have to go and allow specifically traffic for say, 22 or 3 389 for RDP
07:03 because by default, um, security group does not have any inbound rule, but network ACL, default
07:09 network ACL, which comes with the subnet, has both the inbound and outbound traffic allowed.
07:14 So the benefit of network ACL is that you can still block the IP address at the subnet level.
07:20 Now this is a very important.
4. Blocking a Malicious IP Address
时间范围：07:23–08:34
总结 / Summary
中文
当安全组为了公开网站而允许全网访问 HTTPS/443 时，安全组无法显式拒绝某个恶意来源，因为它只支持允许规则。NACL 可以在子网边界添加优先级更高的拒绝规则（deny rule），阻止特定 IP 地址或 CIDR 块（CIDR block），同时继续允许其他客户端访问。
English
When a Security Group allows HTTPS/443 from the Internet for a public website, it cannot explicitly deny one malicious source because Security Groups support allow rules only. A NACL can place a higher-priority deny rule at the subnet boundary to block a specific IP address or CIDR block while continuing to allow other clients.
Transcript
07:22 Now consider a case where you have your web server again hosted on EC2 machine.
07:27 And being a website for example it is running on say port 443.
07:31 And of course in security group you will say so security group rule will say uh, allow port 443, which
07:38 is Https for whole world, right.
07:42 And anybody can access this website.
07:43 But then what happened?
07:45 Maybe there is a, uh, bad bot.
07:47 Right.
07:47 And it's trying to maybe do a DDoS attack or any kind of attack onto your machine.
07:54 Now you know this IP address.
07:56 Let's take some example, say 9999 is a bad IP address.
08:00 It's hitting your website now with security Group.
08:02 You can't block this because security Group does not have any rule to block a given IP address.
08:07 So only thing you can do is you can add your network ACL at subnet level.
08:12 Right.
08:13 So this is network ACL.
08:14 And you can then add a um entry say port 443 for this source IP.
08:21 And you want to deny.
08:23 Right.
08:24 And that's where everybody else can access your website.
08:27 But this particular IP cannot.
08:29 So remember that you can add a deny rule only in the network ACL.
5. NACL Rule Table Example
时间范围：08:34–09:54
总结 / Summary
中文
NACL 规则表包含规则编号（rule number）、流量类型（traffic type）、协议（protocol）、端口（port）、来源（source）以及允许/拒绝动作（allow/deny action）。建议按 100、200、300 等间隔编号，为以后插入新规则保留空间。示例先拒绝恶意来源的全部流量，再允许全网 HTTPS/443；由于先匹配拒绝规则，该恶意来源仍会被阻断。
English
A NACL rule table records the rule number, traffic type, protocol, port, source, and allow/deny action. Numbering rules at intervals such as 100, 200, and 300 leaves room for later insertions. The example first denies all traffic from a malicious source and then allows HTTPS/443 globally; first-match processing ensures that the malicious source remains blocked.
Transcript
08:34 So if you look at the network ACL rules this is an example of the rule.
08:39 So in this case you can see there is a rule number.
08:42 And this rule number could be 1232766.
08:45 Typically it is recommended to have the rule numbers in the order of tens or hundreds.
08:49 That's because in the future if you want to say insert some of the rules, you keep enough buffer in
08:55 between, right?
08:56 So it's always, uh, good to have some gaps in the rule numbers 100, 200, 300 is good enough as long
09:02 as you don't.
09:03 Exhaust.
09:04 Uh, this limit of 3 to 7, six, six.
09:06 So here you can see there is a rule number what type of the traffic it is, protocol port source and
09:12 whether the traffic should be allowed or denied.
09:15 So in this case, the first line says that any traffic from this particular IP address has to be denied.
09:21 So if you are receiving any traffic from this IP address, it will be straightaway denied because it
09:27 will match the first rule.
09:28 So even if the next rule says that four, four, three traffic is allowed, uh, that's an Https traffic.
09:35 But this is already blocked at the first rule.
09:38 So this won't be allowed by the second rule.
09:41 And this is how you can block the traffic from a particular IP address.
09:45 Or you can block it from a particular Cidr block.
09:48 So this is very important uh, with respect to the network ACL.
6. Security Groups vs Network ACLs
时间范围：09:54–12:10
总结 / Summary
中文
安全组（Security Group）实际应用于弹性网络接口（Elastic Network Interface, ENI），常简化描述为实例级；NACL 应用于整个子网。安全组仅支持允许规则并且有状态（stateful），返回流量自动放行；NACL 支持允许和拒绝规则并且无状态（stateless），返回流量必须显式允许。安全组综合评估允许规则，而 NACL 按编号首次匹配。这些差异决定了两者分别适合资源级最小权限控制与子网级粗粒度阻断。
English
Security Groups actually apply to Elastic Network Interfaces (ENIs), often simplified as instance-level protection, while NACLs apply to an entire subnet. Security Groups support allow rules only and are stateful, so return traffic is automatically permitted. NACLs support allow and deny rules and are stateless, requiring explicit return-path rules. Security Groups evaluate their allow rules collectively, whereas NACLs use numbered first-match processing. These differences make them suitable for resource-level least privilege and subnet-level coarse blocking, respectively.
Transcript
09:53 Now just to summarize the differences between the security group and network ACL, very first security
09:59 group operates at instance level.
10:02 Uh, now with the knowledge that we have so far, we are saying that security groups operate at instance
10:08 level.
10:08 But in reality instance has Eni attached and the security groups actually works at any level.
10:16 That means if you are easy to instance, has multiple elastic network interfaces, then there would
10:20 be multiple security groups attached to those.
10:23 Enis.
10:24 But for simplicity we are saying it operates at the instance level.
10:27 However, network ACL works at the subnet level.
10:30 That means all the EC2 instances in that subnet would be affected by the network ACL rules.
10:36 However, if you modify one of the security group, then only the instance to which it is attached will
10:43 be affected by that security group.
10:45 Security group supports only allow rules.
10:48 We have seen that there is no deny, but in network ACL both allow and deny rules are supported.
10:54 Security groups are stateful.
10:56 That means you don't have to explicitly allow the return traffic.
10:59 It automatically goes back.
11:01 But in case of network ACL it's stateless, which means that you have to explicitly have a rule in your
11:07 network ACL for the return traffic.
11:10 Now, when it comes to rule evaluation, there is no deny rule in security groups.
11:15 That means if there is any match for the allowed traffic security group will allow that.
11:21 But in case of network ACL, it goes by the rule number starting with one to maximum number.
11:26 And then uh, if rule matches, it will just uh do that action whether allow or deny and then further
11:33 won't evaluate next rules.
11:35 And this feature of network ACL allows us to deny or block the traffic from particular IP address,
11:41 which is not possible in the security group, because in security group you just write the allow rules.
11:47 There is no deny rule.
11:48 And there are some more additional things listed on this link.
11:52 If you are interested, you can go and read more about this.
11:55 But as of now, this is sufficient, uh, to know about security group and network ACLs, and we'll
12:02 see more advanced feature of the VPC going forward.
12:05 But I hope you understood this part.
12:07 So thank you very much and stay tuned.
整讲总结 / Overall Summary
中文
网络访问控制列表（Network Access Control List, NACL）是子网级无状态防火墙（subnet-level stateless firewall），支持按编号首次匹配的允许与拒绝规则。设计 NACL 时必须同时考虑请求路径和返回路径，特别是临时端口范围（ephemeral port range）。安全组（Security Group）提供资源网络接口级、有状态、仅允许的细粒度控制；NACL 则适合在子网边界阻断特定 IP 或 CIDR。两者组合构成 VPC 的分层防御（defense in depth）。
English
A Network Access Control List (NACL) is a subnet-level stateless firewall that supports numbered, first-match allow and deny rules. Its design must account for both request and return paths, especially ephemeral port ranges. Security Groups provide stateful, allow-only, fine-grained protection at resource network interfaces, while NACLs are useful for blocking specific IPs or CIDRs at subnet boundaries. Together they form defense in depth for a VPC.
返回顶部 ↑