> For the complete documentation index, see [llms.txt](https://mamawhocode.gitbook.io/aws/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://mamawhocode.gitbook.io/aws/services/network/vpc/subnet/nacl.md).

# NACL

## Overview

* is a virtual firewall that controls inbound and outbount traffic at the `SUBNET` level.
* like a passport control officer, who can `allow` or `disallow` a packet go through your `subnet`. 
* contains numbered list of rules. Lowest number = Highest priority.

## vs. Security Group

| level       | instance level                                    | subnet level                                  |
| ----------- | ------------------------------------------------- | --------------------------------------------- |
| state       | statefull                                         | stateless (remember **nothing**)              |
| rule        | only support `Allow` rule                         | support both `Allow` & `Deny` rules           |
| **default** | <p>- deny all inbound<br>- allow all outbound</p> | allow all in/outbound traffic                 |
| evaluate    | all the rule before deciding                      | proceed by pritority number, start from 100.. |

![](/files/CwEVQllegsCXnNvW5fkA)

## Trivia

* Only 1 NACL / subnet
* By default, NACL allows all inbound, outbound traffic
* Once a rule match, NACL stops proceed to the next rule.