What is Network ACL?

Network Access Control Lists filter traffic at the subnet boundary based on IP addresses, ports, and protocols. Unlike security groups (which are stateful — return traffic is automatically allowed), network ACLs are stateless — both inbound and outbound rules must explicitly allow traffic. Rules are evaluated in order by rule number, with the first match determining the action (allow or deny). In AWS, network ACLs protect VPC subnets and complement security groups for defense-in-depth. Enterprise switches use ACLs to segment network traffic between VLANs. Best practice follows deny-by-default, allowing only necessary traffic paths.