NACL Rule Calculator

rules per direction = flows + ephemeral return rules + deny rules; total = rules per direction × 2 because a network ACL is stateless. Unlike a security group, a network ACL keeps no connection state, so every flow needs an inbound rule and a matching outbound rule — and the reply direction has to allow the ephemeral port range (1024–65535, or 32768–60999 for Linux clients) because the source port is chosen at connection time. Rules are evaluated in ascending number order and the first match wins, so leaving gaps between numbers is what lets you insert a rule later without renumbering.

Nearly every mysterious one-way connectivity failure in a VPC traces back to a network ACL that allows the request but not the ephemeral return traffic.

This calculator takes 5 inputs: Distinct traffic flows to allow, Add an ephemeral return-port rule per flow, Explicit deny rules, Rules per direction quota, Rule number increment. The pre-filled defaults are a realistic starting point — replace them with figures from your own environment for a result you can act on.

Security groups are the primary control because they are stateful and follow the instance. Reserve network ACLs for coarse subnet-wide guardrails such as blocking a hostile CIDR block or enforcing a data-tier boundary, where a stateless deny is exactly what you want.

Evaluation stops at the first matching rule, so numbering in increments of 100 leaves room to insert a more specific rule ahead of a broader one later. Renumbering a full ACL under pressure is how outages happen.