Default Network ACL (NACL)

• Applies to all new subnets in the VPC until explicitly replaced.

• Permissive by default: allows all inbound and outbound IPv4 traffic.

• State: stateless — return traffic must be explicitly allowed in custom NACLs (but already allowed in default NACL).

• Not recommended for production — better to create a custom NACL with explicit allow/deny rules.

Default Inbound Rules

Default Outbound Rules

Best Practice

• Leave the default NACL unchanged — it’s useful for troubleshooting and temporary testing.

• For production workloads, create custom NACLs to enforce least privilege.