I have a VPC with 3 subnets:

  1. Public (FE layer, inbound internet access only)
  2. Protected (app layer, outbound internet access only)
  3. Private (DB layer, no internet access at all)

The public subnet NACL blocks all inbound from the internet on any ports other than 443.

The private subnet NACL blocks all in and out from the internet.

The NACL for the protected subnet has to allow:

  • outbound on 443 to for outbound internet https requests
  • inbound from on 1024-65535 for responses to those requests

The protected subnet routes to the internet through a NAT Gateway, which lives in the public subnet.

The problem is this: outbound traffic from the protected subnet to the internet only works if the NACL for the public subnet is opened to allow inbound on ports 1024 - 65535. This is presumably because the traffic goes through the public subnet (since that's where the NAT Gateway lives).

So I can open up the NACL for the public subnet (inbound from on 1024-65535), but that makes it less secure; in fact if I'm opening all those ports, I may as well just not bother with a NACL at all (obviously I am also using security groups).

Am I missing something?

1 Answer 1


NACLs are stateless. You've discovered that you need to open the Ephemeral Ports to allow traffic back into your subnet. Do some reading around ephemeral ports.

Typically you're better off using security groups rather than NACLs, as they're stateful and cater for ephemeral ports automatically. You can use both if you like.

I typically only use two subnets, public and private. Public has only NAT gateway or load balancer, and that subnet allows public IPs. The private subnet has all internal resources, and I tier using security groups rather than subnets.

For example, create a security group for web servers, a security group for app servers, and a security group for database servers, then allow access between security groups on the ports you require.


  • The web server SG accepts traffic from on 443
  • The app server SG accepts traffic only from the web server subnet on 443, and allows outbound traffic to the database SG
  • The database SG allows traffic only on port 3306 from the app server SG
  • I know that NACLs are stateless, and what ephemeral ports are. And I am using SGs, as I stated in the question, much as per your example. But I would like to use NACLs too for extra security. It sounds like the summary of your answer should be "no, you're not missing anything. Make sure your SGs are locked down well since NACLs won't stop much inbound traffic to your public or protected subnets".
    – mdarwin
    Aug 3, 2020 at 9:25
  • Yep, that's about right, things sound fine. You sounded surprised that you need to open your NACLs to ephemeral ports, and since you hadn't mentioned "stateless" or "ephemeral" my assumption was you needed a bit of a pointer there. Is there a problem you need help with, or were you just checking things sounded right?
    – Tim
    Aug 3, 2020 at 9:47

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.