24

I don't find easily the difference between those AWS VPC options.

3
  • 2
    Please write your questions in English while you're on the English version of StackOverflow. Thank you.
    – THess
    Feb 13, 2020 at 15:43
  • Thanks for your feedback! Feb 13, 2020 at 16:02
  • I can see why none of the answers have been accepted.
    – NeilG
    May 19 at 16:48

5 Answers 5

40

A Network Access Control List (Network ACL, or NACL) is a firewall for a subnet.

All traffic entering or exiting a subnet is checked against the NACL rules to determine whether the traffic is allowed in/out of the subnet.

Traffic between instances within the same subnet do not pass through a NACL because the traffic is not exiting the subnet.

NACL rules are executed in a defined order. The first rule that matches the traffic will determine whether the traffic is allowed or denied.

Typically, NACLs are left at their default value of permitting all traffic. You should never have a need to modify a NACL unless you have a specific need, such as:

  • Created a DMZ
  • Blocking specific types of traffic to all resources (eg blocking ICMP PING)
  • Blocking specific IP addresses that are performing DDOS attacks

A Route Table is used to direct traffic in/out of a subnet. It contains a number of CIDRs (IP address ranges) and where to direct the appropriate traffic.

For example:

  • Traffic for the Internet (0.0.0.0/0) is usually:
    • Sent to an Internet Gateway if the Route Table is associated with a public subnet
    • Sent to a NAT Gateway if the Route Table is associated with a private subnet
  • Traffic for a Peered VPC is sent across a VPC Peering connection

It literally routes the traffic to the correct destination.

Want to know what makes a Public Subnet 'public'? It is the fact that the Route Table sends Internet-bound traffic to 0.0.0.0/0.

Traffic is sent to the smallest CIDR range that matches the destination. So, traffic matching 10.1.0.0/16 would be directed before traffic matching 0.0.0.0/0.

3
  • Is “allowed/rules” vs “directed/specified” a good distinction?
    – Kermit
    Aug 28, 2021 at 22:29
  • 1
    Spectacular explanation, Much appreciated
    – Amir
    Sep 3, 2021 at 15:42
  • yes, but what's the difference?
    – NeilG
    May 19 at 16:36
18

The answers provided here are quite detailed and good. Another way of looking at this would be your home, where you've two robot programme/system called Network ACL and Route Table.

Network ACL

  • If someone is coming from my in-laws, DENY/ALLOW entry
  • If anyone is leaving my house, DENY/ALLOW entry
  • If my friends from Sussex are here, ALLOW/DENY entry
  • EVERYONE ELSE is DENIED

Route Table

  • WHOEVER wants to BE WITHIN INDOORS will use USUAL ROUTE(s)
  • WHOEVER wants to BE IN BACKYARD will use KITCHEN ROUTE
  • EVERYONE ELSE need to use MAIN DOOR ROUTE

Difference is that without actually having INGRESS into your house, an entity/individual cannot ROUTE oneself to different destinations. So, you can define lots of ROUTEs, but without having NACL, it's counter-intuitive. However, with only NACL, you can just oversimplify your house routes as ROUTE YOURSELF TO WHICHEVER PLACE AS YOU PLEASE.

I hope it was a good enough oversimplification :)

2
  • This is too good of explanation. With NACL, we can declare Person X,Y,Z ALLOW to your house and deny person A,B,C DENY. In route table, person X to Kitchen route, person Y to Living room route. Is this correct ? What happens, If we dont define anything for person Z in route table ? Can Z access anything in the house ?
    – Srivi
    Feb 19, 2021 at 4:58
  • 1
    They key is to understand the difference between "Route" and "Access". NACL and Security Groups are about access control, firewall etc. Routing is about specifying routes. You need the combination of both to have networking and security done properly. Also, Z is a person (IAM) not network.
    – ha9u63a7
    Feb 20, 2021 at 14:45
7

Network ACL are stateless Firewall Rules for Incoming and Outgoing Packages and filter Network traffic. This is used for security.

Route Tables is routing configuration between your VPCs and Internet and route network traffic. This is used for communication in networks with multiple IP- Ranges (public / private )

1

In theory, you can define multiple route tables and swap them in and out depending on how you want to control the traffic. However, in practice, it helps if you have general rules (Routes) and then tightening the rules (ACLs) as is necessary. For example:

  • In general, you want this house to accept (or redirect) all people that are wearing shirts with green in them. This is accomplished with a route table.
  • However, depending on the holiday seasons, you might want to tighten those rules. For example, during Christmas, you only want green shirts that also have red colors in them also. This is done using an ACL.

Thus, you can swap out ACLs as is needed without removing the general rules underneath. ACLs also allow special rules for outbound as well as inbound traffic, so you can allow certain "people" to enter, but forbid them from leaving, for example.

1

Both Network ACL (Access Control List) and Route Tables will be encountered when you learn AWS VPC (virtual private cloud).

The biggest difference is that they work for different objects:

  • Network ACL works as a firewall protecting a subnet of a VPC (a VPC can involve multiple subnets).
  • Route Table manages traffic flow among subnets of a VPC ( When you create a new VPC, a route table named as 'main route table' is created by default).

Let's say you have created a VPC, and created 2 subnets, subnet-A and subnet-B in the VPC. Each subnet contains a instance, for example, subnet-A contains a instance of EC2 (named as EC2-A), subnet-B contains another instance of EC2 (named as EC2-B).

Your VPC must have a route table which allows traffic between the two subnets. That means data can "walk" from subnet-A to subnet-B, and from subnet-B to subnet-A.

However, could EC2-A get data sent from EC2-B ? Could EC2-B get data sent from EC2-A ? It depends on the Network ACLs belong to the two subnets respectively.

For example, if

  • subnet-A's Network ACL blocks inbound traffic and allows outbound traffic
  • subnet-B's Network ACL allows inbound traffic and blocks outbound traffic

then, EC2-B can hear from EC2-A, but cannot reply.

Hope the above description can do a help.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.