# NACL

A **Network Access Control List (NACL)** is a **stateless firewall** that controls inbound and outbound traffic at the **subnet level**. Unlike **Security Groups**, NACLs evaluate **rules in numerical order**, from **lowest to highest** rule number.

✔ **Use Cases for NACLs**

* Blocking malicious IPs or specific traffic types.
* Allowing access to specific trusted networks.
* Enforcing additional security layers beyond Security Groups.

🚀 **SecureCart Use Case**\
SecureCart, an **e-commerce platform**, implements NACLs to **protect its subnets** from unauthorized access, control external communication, and **block malicious traffic**.

***

### **🔹 Scenario 1: Block All Traffic from a Malicious IP (Deny)**

✔ SecureCart detects **multiple failed login attempts** from **IP `203.0.113.55`** and wants to block it from accessing any subnet.

| **Rule #** | **Type**    | **Protocol** | **Port Range** | **Source** / **Destination** | **Action** |
| ---------- | ----------- | ------------ | -------------- | ---------------------------- | ---------- |
| 100        | All Traffic | ALL          | ALL            | `203.0.113.55/32`            | DENY       |

✅ **Best Practice**: Always place **deny rules before allow rules** to prevent unintended access.

***

### **🔹 Scenario 2: Allow Internet Access for a Public Subnet (Allow)**

✔ SecureCart’s **frontend web servers** in a **public subnet** need outbound internet access to fetch **external APIs** and software updates.

| **Rule #** | **Type**                   | **Protocol** | **Port Range** | **Destination** | **Action** |
| ---------- | -------------------------- | ------------ | -------------- | --------------- | ---------- |
| 100        | HTTP (Web Traffic)         | TCP          | 80             | `0.0.0.0/0`     | ALLOW      |
| 110        | HTTPS (Secure Web Traffic) | TCP          | 443            | `0.0.0.0/0`     | ALLOW      |

✅ **Best Practice**: Ensure that the **associated route table** has a **default route to an Internet Gateway**.

***

### **🔹 Scenario 3: Restrict Database Access to Only the Application Subnet (Allow)**

✔ SecureCart’s **MySQL database (RDS instance)** is in a **private subnet**. The **only allowed access** should come from the **application servers in a different subnet**.

| **Rule #** | **Type**     | **Protocol** | **Port Range** | **Source**                 | **Action** |
| ---------- | ------------ | ------------ | -------------- | -------------------------- | ---------- |
| 100        | MySQL/Aurora | TCP          | 3306           | `10.0.1.0/24` (App Subnet) | ALLOW      |
| 120        | All Traffic  | ALL          | ALL            | `0.0.0.0/0`                | DENY       |

✅ **Best Practice**: Restrict database access to **only necessary subnets** to **reduce attack surface**.

***

### **🔹 Scenario 4: Allow VPC Peering Traffic (Allow)**

✔ SecureCart has **two VPCs connected via VPC Peering**. **Application servers in VPC-A** need to access **APIs in VPC-B** over **port 8080**.

| **Rule #** | **Type**        | **Protocol** | **Port Range** | **Source**            | **Action** |
| ---------- | --------------- | ------------ | -------------- | --------------------- | ---------- |
| 100        | Custom TCP Rule | TCP          | 8080           | `10.0.2.0/24` (VPC-B) | ALLOW      |

✅ **Best Practice**: Add a **corresponding outbound rule** in **both VPCs** to ensure bidirectional traffic.

***

### **🔹 Scenario 5: Deny All Traffic by Default (Deny)**

✔ SecureCart **implements a default deny policy** for better security.\
🚨 **By default, NACLs allow all traffic unless an explicit DENY rule is added**.

| **Rule #**      | **Type**    | **Protocol** | **Port Range** | **Source/Destination** | **Action** |
| --------------- | ----------- | ------------ | -------------- | ---------------------- | ---------- |
| *Explicit Rule* | All Traffic | ALL          | ALL            | `0.0.0.0/0`            | DENY       |

✅ **Best Practice**: This ensures that **only explicitly allowed rules** take effect.

***

### **🔹 Scenario 6: Allow Outbound Access for Software Updates (Allow)**

✔ SecureCart's **EC2 instances in private subnets** need **outbound internet access** via a **NAT Gateway**.

| **Rule #** | **Type** | **Protocol** | **Port Range** | **Destination** | **Action** |
| ---------- | -------- | ------------ | -------------- | --------------- | ---------- |
| 100        | HTTP     | TCP          | 80             | `0.0.0.0/0`     | ALLOW      |
| 110        | HTTPS    | TCP          | 443            | `0.0.0.0/0`     | ALLOW      |

✅ **Best Practice**: The **NAT Gateway must be placed in a public subnet** to facilitate outbound traffic.

***

### **🚀 Summary**

🔹 **Network ACLs (NACLs) provide an additional layer of security** at the **subnet level**, acting as a **stateless firewall**.\
🔹 **Deny rules should be placed before Allow rules** to prevent unintended access.\
🔹 SecureCart uses **NACLs to restrict database access, block malicious IPs, and secure VPC peering**.\
🔹 **Best practices include default deny rules, least privilege access, and proper rule ordering.**