Security groups and network ACLs: follow the return packet
Compare AWS security groups and network ACLs with a complete HTTPS request and return path. Diagnose ephemeral-port rules without opening entire subnets.
TL;DR: AWS security groups track connections and combine allow rules, while network ACLs apply ordered allow or deny rules independently to packets entering and leaving a subnet. For an ACL, write the return packet's addresses and ports before choosing a rule.
Place each filter on the network path
A security group controls traffic associated with network interfaces and supports allow rules. Applicable security-group permissions combine; adding another restrictive-looking group does not subtract an allowance from an existing group. AWS security-group documentation explains the stateful behavior and connection-tracking considerations.
A network ACL applies at a subnet boundary. It processes rules in number order and uses the first match, including explicit deny rules. Its stateless behavior means return traffic needs a corresponding allowance. See AWS network ACLs.
Neither mechanism supplies a route. A perfectly allowed packet can still fail because the subnet route design has no usable path or because the service is not listening.
| Property | Security group | Network ACL |
|---|---|---|
| Association | Network interface or supported resource | Subnet |
| Rule decision | Allowed by applicable rules | First matching numbered rule |
| Explicit deny | No | Yes |
| Return traffic | Connection tracking normally admits replies | Evaluated against the opposite-direction rules |
| Typical design role | Workload access relationships | Subnet-level restrictions or additional filtering |
Trace an HTTPS request with real port roles
Take a hypothetical client at 10.20.1.15 in subnet A connecting to a server at 10.20.2.40 in subnet B. The client chooses source port 49160; the server listens on 443. Both subnets have routes to each other, and no address translation occurs on this path.
| Packet crossing | Source | Destination | ACL direction at that boundary |
|---|---|---|---|
| Request leaves A | 10.20.1.15:49160 | 10.20.2.40:443 | A outbound |
| Request enters B | 10.20.1.15:49160 | 10.20.2.40:443 | B inbound |
| Reply leaves B | 10.20.2.40:443 | 10.20.1.15:49160 | B outbound |
| Reply enters A | 10.20.2.40:443 | 10.20.1.15:49160 | A inbound |
AWS TCP ACL port ranges select the packet's destination port. In this example, request-path rules need destination port 443, while reply-path rules need destination port 49160 within the client's ephemeral range. The client's operating system and network path determine the appropriate range; do not copy one platform's range into every network design.
The return arrows show why “443 is open” is incomplete evidence. A packet capture may show the SYN arriving at the server while the SYN-ACK never reaches the client.
Diagnose a change to one subnet
Suppose HTTPS succeeds from subnet C but times out from subnet A after an ACL change. Compare the exact source addresses, routes and rule evaluation for both paths. Find the first matching rule for each direction. An allow rule numbered 200 cannot rescue traffic already denied by rule 100.
Use flow logs and endpoint evidence to narrow where packets disappear. A rejected record identifies a filtering problem worth investigating, but retain enough context to distinguish the relevant interface and direction. Check the destination process too; silence from a port with no listener is a different failure from a packet dropped at a subnet boundary.
Choose a narrow correction that matches the intended callers and return path. Do not start by allowing all traffic between all subnets. That may restore the test while concealing the actual rule error and expanding access far beyond the application.
Understand what stateful does and does not promise
For an established, tracked connection, a security group does not require you to mirror every return-packet rule manually. That convenience is not an application authentication mechanism. An allowed network path still needs TLS identity and authorization at the service.
Connection tracking also affects rule-change expectations. Do not promise that removing an allow rule instantly terminates every existing connection. Check the resource's tracking behavior and design any urgent session revocation deliberately. Network policy changes and application credential revocation solve different parts of an access incident.
An interview follow-up often changes the path by adding NAT or a load balancer. Redraw the packet as seen at each boundary; a proxy creates another connection with different addresses and ports. Reusing the original client tuple across every hop produces incorrect ACL reasoning.
Verify the explanation against a failed reply
Self-check: subnet B permits inbound destination port 443 and outbound destination port 443. Will the example connection necessarily work?
No. The reply targets the client's chosen port 49160. B's outbound ACL must admit that return traffic, and A's inbound ACL must admit it too. Security groups, routing and a listening application also have to permit the connection. State the assumptions before concluding which rule is responsible.
A host adds another filtering boundary. nftables and connection tracking explains chain priority and why existing sessions can survive a change that blocks new ones.