Security groups and NACLs

A security group (AWS) or VPC firewall rule (GCP) decides which traffic may reach a resource. A network ACL (NACL, AWS) filters traffic at the subnet boundary. Both are firewalls, but they work differently, and mixing them up causes outages.

The big idea

A security group is like a bouncer on the door of each building that remembers who came in. If you let a guest in, the guest can also leave, and nobody has to write down a separate exit permission. A NACL is like a checkpoint on the road. Every car is checked on the way in and again on the way out, and the exit needs its own rule.

That is the difference in one line. Security groups are stateful: return traffic is allowed automatically. NACLs are stateless: return traffic needs its own rule.

Walking through an example

Three tiers, each with its own group. Each rule names another group, not an address range.

Follow one request. The load balancer opens a connection to an app instance on port 8080. app-sg allows that inbound. The app's reply travels back on the same connection, and the security group allows it without a separate rule. If an app instance is replaced, the new one joins app-sg, and the rules still apply. Nobody edits an IP list.

NACLs need more care. They are checked in numbered order, and they allow or deny. A reply from port 8080 goes back to a random high port on the client. The NACL must allow that ephemeral port range on the way out, or the connection silently fails.

Security group (stateful)   inbound 8080 allowed  -> reply allowed automatically
NACL (stateless)            inbound 8080 allowed  -> reply to ephemeral ports 1024-65535 must also be allowed

GCP firewall rules can target network tags or service accounts instead of IP ranges, which is usually safer.

Common mistakes

• Allowing SSH from 0.0.0.0/0. Use Session Manager or IAP and restrict by IAM.
• Locking down NACLs and forgetting the ephemeral ports. Connections fail with no obvious error.
• Using CIDR lists between tiers. When instances change, the list goes stale. Reference the group instead.

Check yourself

1. You allow inbound 443 on a security group. Do you need an outbound rule for the reply? Answer: No. Security groups are stateful, so the reply is allowed automatically.
2. Why does a restrictive NACL break connections that look correctly allowed? Answer: NACLs are stateless, so the return traffic on ephemeral ports needs its own rule.

Key takeaways

• Security groups are stateful and are the primary control. Allow only what each tier needs.
• NACLs are stateless and per subnet. Keep them simple, and remember ephemeral ports.
• Reference other security groups, so membership follows instances as they change.
• Never open SSH to the world. Use IAM-based admin access.

Further learning

Next, see how networks and cloud services connect across boundaries: connecting VPCs and private endpoints.