Module 4 of 6 • Defense-in-Depth & Cloud Firewalls
Security Groups vs. Network ACLs: Making Connections Secure
Every packet inside an AWS VPC passes through two different security checkpoints:
the Network ACL (Stateless Subnet Guard) and the Security Group (Stateful ENI Bodyguard).
Flip the firewall rules on the right and run the 3 packet tests below to see how they work together!
🛡️
Stateless vs. Stateful in Plain English:
A Network ACL (NACL) is like a border guard with amnesia at the neighborhood gate—even if he lets you in, he checks his rulebook from scratch when you try to walk back out!
A Security Group (SG) is like a personal VIP bodyguard standing right at the server's door (ENI)—once he checks your ID and lets you in, he remembers your face and automatically lets your reply back out.