--- title: "Security Groups vs. NACLs Cheat Sheet | Cybr" description: "Security Groups vs. NACLs Cheat Sheet" url: https://cybr.com/cheat-sheets/nacl-vs-sgs/ --- # Security Groups vs. NACLs Cheat Sheet [**Cybr**](https://cybr.com/) [christophelimp](https://x.com/christophelimp) [christophe limpalair](https://www.linkedin.com/in/christophelimpalair/) [https://cybr.com](https://cybr.com/) ## Comparison | Comparison | Security Groups (SGs) | Network Access Control Lists (NACLs) | | --- | --- | --- | | Scope | Operate at the instance level | Operate at the subnet level (sort of like network-based firewalls) | | Maintains state? | Yes - Stateful Automatically allows outbound traffic if it was allowed inbound and vice versa | No - Stateless Does not automatically allow outbound traffic if it was allowed inbound or vice versa | | Rule evaluation | All security group rules are evaluated and access is permitted if any security group rule permits access | Evaluates rules in order from lowest number to highest until there’s a match (ie: Rule #100 evaluates before #110, and if it matches the request, rule #110 never gets evaluated) | | How are they applied? | Multiple can be applied to a single host | Only one NACL can be applied per subnet, but the same NACL can be applied to multiple subnets | | Permissions | Can only specify allow rules, not deny rules. Deny is the default. Can have both inbound and outbound rules, but neither is technically required | Can specify both allow and deny, and there’s a catch-all deny if nothing matches. Has inbound and outbound rules and both are required | | Anatomy of rules | - Name - Rule ID - IP version (IPv4, IPv6, or blank) - Protocol Type (ie: HTTPS, All Traffic, etc) - Protocol (ie: TCP) - Port range - Source or destination (can even reference security groups) - Description (optional) | - Rule number - Type (ie: SSH) - Protocol (ie: ICMP, TCP, etc) - Port range (ie: 22, 1024 - 65536, etc) - Source (inbound rules only) - Destination (outbound rules only) - Allow/Deny | | Examples | Allow requests with specific Protocols/Ports/IPs to reach or leave hosts. Should be very specific and as restrictive as possible. | Allow or Block requests Protocols/Ports/IPs to enter or leave specific subnets. Tends to be broader than SGs. \* It’s important to note that NACLs only control traffic entering or leaving subnets, not intra-subnet traffic | ## Examples ### Security Group Rules - Example access rules for web server instances Inbound | Protocol type | Protocol number | Port | Source IP | Notes | | --- | --- | --- | --- | --- | | TCP | 6 | 80 (HTTP) | 0.0.0.0/0 | Allows inbound HTTP access from any IPv4 address | | TCP | 6 | 443 (HTTPS) | 0.0.0.0/0 | Allows inbound HTTPS access from any IPv4 address | | TCP | 6 | 80 (HTTP) | ::/0 | Allows inbound HTTP access from any IPv6 address | | TCP | 6 | 443 (HTTPS) | ::/0 | Allows inbound HTTPS access from any IPv6 address | Source: [https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/security-group-rules-reference.html#sg-rules-web-server](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/security-group-rules-reference.html#sg-rules-web-server) ### NACL Rules - Example access rules for subnets hosting web servers Inbound | Rule # | Type | Protocol | Port range | Source | Allow/Deny | Comments | | --- | --- | --- | --- | --- | --- | --- | | 100 | HTTP | TCP | 80 | 0.0.0.0/0 | ALLOW | Allows inbound HTTP traffic from any IPv4 address. | | 110 | HTTPS | TCP | 443 | 0.0.0.0/0 | ALLOW | Allows inbound HTTPS traffic from any IPv4 address. | | 120 | SSH | TCP | 22 | 192.0.2.0/24 | ALLOW | Allows inbound SSH traffic from a specific public IPv4 address range | | 140 | Custom TCP | TCP | 32768-65535 | 0.0.0.0/0 | ALLOW | Allows inbound return IPv4 traffic from the internet (that is, for requests that originate in the subnet). | | \* | All traffic | All | All | 0.0.0.0/0 | DENY | Catch-all deny rule (can’t be modified or removed) | Outbound | Rule # | Type | Protocol | Port range | Destination | Allow/Deny | Comments | | --- | --- | --- | --- | --- | --- | --- | | 100 | HTTP | TCP | 80 | 0.0.0.0/0 | ALLOW | Allows outbound IPv4 HTTP traffic from the subnet to the internet. | | 110 | HTTPS | TCP | 443 | 0.0.0.0/0 | ALLOW | Allows outbound IPv4 HTTPS traffic from the subnet to the internet. | | 120 | SSH | TCP | 1024-65535 | 192.0.2.0/24 | ALLOW | Allows outbound SSH traffic from a specific public IPv4 address range | | 140 | Custom TCP | TCP | 32768-65535 | 0.0.0.0/0 | ALLOW | Allows outbound IPv4 responses to clients on the internet | | \* | All traffic | All | All | 0.0.0.0/0 | DENY | Catch-all deny rule (can’t be modified or removed) | Source: [https://docs.aws.amazon.com/vpc/latest/userguide/vpc-network-acls.html](https://docs.aws.amazon.com/vpc/latest/userguide/vpc-network-acls.html) **Security Groups vs. NACLs** ## Use this cheat sheet with AI Copy a ready-to-use prompt into your preferred AI assistant. Goal Preview prompt Prompt [More cheat sheets](https://cybr.com/cheat-sheets/)