Stateful versus Stateless Behavior

The deepest difference between security groups and network ACLs is state tracking. Security groups are stateful; network ACLs are stateless. This single property changes how you write rules, troubleshoot dropped traffic, and reason about return packets.

Stateful means the firewall remembers each connection it permits. When a security group allows an inbound request, it automatically allows the matching response back out, tracking the connection in a state table. You never write a rule for return traffic.

Stateless means the firewall evaluates every packet independently with no memory of prior packets. A network ACL that allows an inbound request does not automatically allow the response. You must add a separate rule for the return direction, or the reply is dropped.

A client connects to your web server on port 443. The server replies from port 443 to the client on a high ephemeral port. With a security group, this reply is automatic. With a NACL, you need an outbound allow for the ephemeral range, or the connection appears to hang and then fails.

Forgetting ephemeral ports in NACL outbound rules is the most common stateless mistake. The request reaches the server but the response is silently rejected. Always allow the relevant ephemeral range (commonly 1024–65535) for outbound replies in custom NACLs.

When traffic is mysteriously blocked, check the layer that matches the symptom. If a connection establishes but replies fail, suspect a stateless NACL missing ephemeral ports. If nothing connects at all, suspect a missing security group allow or a NACL deny on the request port.

For inbound traffic to a resource, the NACL is evaluated first at the subnet edge, then the security group at the ENI. For outbound, the security group is checked first, then the NACL. Both must permit the traffic for it to pass, so either layer can silently block a flow.

Statefulness makes security groups simpler to manage and is why they are the everyday tool. You describe intent once and return traffic just works. Stateless NACLs require double the rules and careful port math, which is why they are used selectively.

Statelessness is occasionally an advantage. Because NACLs treat each packet alone, a deny rule blocks traffic in one direction without affecting the other and applies to all connections instantly, including established ones. This makes NACLs effective for hard, immediate blocks during incidents.

Changing a security group rule affects existing tracked connections for new packets, but state tracking can keep some flows alive briefly. A NACL deny, being stateless, takes effect on the very next packet of any connection. This immediacy matters when containing an active attacker.

Think of the security group as a smart bouncer who remembers who he let in and waves them back out, and the NACL as a rule sheet checked per packet with no memory. Knowing which is stateful is one of the most tested facts on the SCS-C02 exam.

Apply the stateful versus stateless distinction.

Security groups are stateful: permitted requests get automatic return traffic. Network ACLs are stateless: every packet is judged alone, so you must explicitly allow ephemeral ports for replies. Inbound order is NACL then SG; outbound is SG then NACL, and both must permit. Connections that establish but whose replies fail signal a stateless ephemeral-port gap.