Network ACL
A network access control list (ACL) is an optional layer of security for your VPC that acts as a firewall for controlling traffic in and out of one or more subnets. You might set up network ACLs with rules similar to your security groups in order to add an additional layer of security to your VPC.
Network Access Lists - AWS Official Documentation
Note:
One Subnet can be associated with one and only one NACL but One NACL can have multiple subnet associated with it.
To create a custom NACL:
1. Select Security --->Network ACLs
2. You can see there is already a NACL defined for your subnets (Public and Private).
3. Click on create Network ACL button
4. Provide the following settings
NACL Name: mynacl
VPC: myvpc1
Click on Create Network ACL
5. select mynacl and click on Subnet Association Tab and select public subnet.
6. Click on Inbound Rules and Click on Edit InBound Rules and Allow access to port number 22.
7. Create an Ec2 instance in myvpc-1 and subnet public subnet and try to connect with port number 22.
You will not able to connect because on NACL level we have opened port 22 for Inbound level not for Outbound level, so let's open port number 22 for outbound level as well. (I am opening ALL Traffic because we are not sure that outbound is port number 22 or something else port number)
8. Select mynacl and click on outbound rules tab and Edit Outbound rule by Allowing All Traffic.
Experiments
1. Host a website on EC2 instance on port number 80 and remove outbound rule and check you are able to access it externally or not.
2. Try to access google.com on your Ec2 instance.
