Skip to content
ENExplore Calculators

NACL Rule Calculator

Size a stateless network ACL: rules per direction including ephemeral return traffic, rule numbering and the 20-rule quota.

About NACL Rule Calculator

Unlike a security group, a network ACL keeps no connection state, so every flow needs an inbound rule and a matching outbound rule — and the reply direction has to allow the ephemeral port range (1024–65535, or 32768–60999 for Linux clients) because the source port is chosen at connection time. Rules are evaluated in ascending number order and the first match wins, so leaving gaps between numbers is what lets you insert a rule later without renumbering. Nearly every mysterious one-way connectivity failure in a VPC traces back to a network ACL that allows the request but not the ephemeral return traffic.

Formula

NACL Rule

rules per direction = flows + ephemeral return rules + deny rules; total = rules per direction × 2 because a network ACL is stateless.

flows
Traffic patterns you intend to allow
ephemeral return rules
Rules for the high ports that replies arrive on
quota
Rules allowed per direction, 20 by default and 40 at most

Worked example

With the default values below, NACL Rule Calculator returns Rules per Direction of 18. Change any input above and every figure here is recalculated in your browser.

Inputs used

Distinct traffic flows to allowaccepts 1–200 flows
8 flows
Add an ephemeral return-port rule per flow
Yes
Explicit deny rulesaccepts 0–100 rules
2 rules
Rules per direction quotaaccepts 5–40 rules
20 rules
Rule number incrementaccepts 1–1,000 steps
100 steps

Results

Rules per Direction
18
Total Rules in Both Directions
36
Highest Rule Number Used
1,800
Quota Headroom per Direction
10.0%
Quota Check
Within the 20-rule default quota per direction

Step by step

  1. 1Values used
  2. 2NACL Rule
  3. 3Rules per Direction= 18
  4. 4Total Rules in Both Directions= 36
  5. 5Highest Rule Number Used= 1,800
  6. 6Quota Headroom per Direction= 10.0
  7. 7Quota Check= Within the 20-rule default quota per direction

Assumptions and limits

  • The result is derived only from the 5 inputs listed above. Anything not among them is not part of the calculation.
  • In particular, this calculator does not take inflation, tax, fees or charges or compounding frequency into account.
  • Figures are rounded for display to 1 decimal place, so totals built from several rounded parts can differ slightly from the unrounded arithmetic.

How these calculators are built and tested is described on the Methodology page. If a figure looks wrong, please report it.

Frequently Asked Questions

How is NACL Rule calculated?

rules per direction = flows + ephemeral return rules + deny rules; total = rules per direction × 2 because a network ACL is stateless. Unlike a security group, a network ACL keeps no connection state, so every flow needs an inbound rule and a matching outbound rule — and the reply direction has to allow the ephemeral port range (1024–65535, or 32768–60999 for Linux clients) because the source port is chosen at connection time. Rules are evaluated in ascending number order and the first match wins, so leaving gaps between numbers is what lets you insert a rule later without renumbering.

Why does NACL Rule matter?

Nearly every mysterious one-way connectivity failure in a VPC traces back to a network ACL that allows the request but not the ephemeral return traffic.

What values do I need to enter?

This calculator takes 5 inputs: Distinct traffic flows to allow, Add an ephemeral return-port rule per flow, Explicit deny rules, Rules per direction quota, Rule number increment. The pre-filled defaults are a realistic starting point — replace them with figures from your own environment for a result you can act on.

Should I use network ACLs or security groups?

Security groups are the primary control because they are stateful and follow the instance. Reserve network ACLs for coarse subnet-wide guardrails such as blocking a hostile CIDR block or enforcing a data-tier boundary, where a stateless deny is exactly what you want.

Why leave gaps in rule numbers?

Evaluation stops at the first matching rule, so numbering in increments of 100 leaves room to insert a more specific rule ahead of a broader one later. Renumbering a full ACL under pressure is how outages happen.

Related Calculators

NACL Rule Calculator – Calculate Rules per Direction