# Design both directions of stateless AWS network ACL rules

> Include return paths and rule order when filtering at the subnet boundary.

- Canonical URL: https://update.dsesecurity.com/updates/design-both-directions-of-stateless-aws-network-acl-rules/
- Publisher: Detection Systems & Engineering (DSE Security)
- Author: DSE Security Editorial Team
- Published: 2026-10-20T18:13:54+00:00
- Modified: 2026-10-20T18:34:29+00:00
- Last reviewed by DSE: 2026-10-20
- Resource type: Guide
- DSE priority: Information
- Topics: Cybersecurity, Networks & Infrastructure
- Reading time: 2 minutes

## What you need to know

Include return paths and rule order when filtering at the subnet boundary.

## Potentially affected

This applies to VPC subnet ACL design, with the documented exclusions for metadata, DNS and other special traffic.

## DSE recommendation

DSE recommends documenting both packet directions for each required application exchange before editing an ACL.

## Article

Include return paths and rule order when filtering at the subnet boundary.

## Source facts

A VPC network ACL evaluates numbered inbound and outbound allow or deny rules in ascending order and uses the first match. ACLs are stateless, so an allowed request does not automatically permit its response. AWS evaluates them when traffic enters or leaves a subnet, not while traffic stays within that subnet.

Source: [AWS Documentation](https://docs.aws.amazon.com/vpc/latest/userguide/vpc-network-acls.html).

## Applicability

This applies to VPC subnet ACL design, with the documented exclusions for metadata, DNS and other special traffic.

## DSE recommendation

DSE recommends documenting both packet directions for each required application exchange before editing an ACL. Include the actual client return-port behavior and preserve space in rule numbering for later changes. Review the subnet association and existing first-match rules rather than adding a late allow that an earlier deny already defeats. Keep the old ACL configuration and a tested management route available. Coordinate the change with security-group and routing owners so a single failed request does not cause unrelated controls to be widened. Have the reviewer walk one permitted request and its response through the numbered rules before the change. Keep the expected first match for each direction in the evidence, and identify which independent control would still block an intentionally denied test flow.

## Verification

Proposed verification: test an approved request and its response across the subnet boundary, then inspect the expected first-match rule in each direction. Include a deliberately denied flow. Record observed source, destination and port values instead of assuming every client uses the same ephemeral range.

## Official reference

[AWS Documentation](https://docs.aws.amazon.com/vpc/latest/userguide/vpc-network-acls.html). Reviewed October 20, 2026.

## Primary reference

- Name: AWS Documentation
- Authority: docs.aws.amazon.com
- URL: https://docs.aws.amazon.com/vpc/latest/userguide/vpc-network-acls.html
- Source publication date: Not stated by the source

## Citation and use

Preferred citation: “Design both directions of stateless AWS network ACL rules,” DSE Security, https://update.dsesecurity.com/updates/design-both-directions-of-stateless-aws-network-acl-rules/
Publishing principles: https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/
Usage and citation policy: https://update.dsesecurity.com/usage/
Copyright © 2026 Detection Systems & Engineering. All rights reserved.