Inbound allowed, replies not
Establishes and then hangs, with a security group that is plainly correct
100 inbound allow tcp 443 0.0.0.0/0 100 outbound allow tcp 443 0.0.0.0/0
AWS Network ACL Return Traffic Checker
If a security group is open and the connection still hangs, this is almost always why. A network ACL is stateless, so the reply needs a rule of its own.
Paste below, or drop a file anywhere on this panel
Or drop a file anywhere on this panel. Nothing is uploaded: the analysis runs in this tab.
The answer appears here
Paste on the left and press Check. Nothing leaves this tab.
Formatted
Results
Nothing else to flag.
No formatting problems, and nothing the rules object to. Worth remembering what that covers: this reads the file you pasted, not the account or cluster it will be applied to.
No finding matches that filter.
Examples
Real input you can load into the tool above. Each one shows a different thing going wrong, because that is what the tool is for.
A deny numbered below an allow
Evaluation stops at the first match, so the allow never runs
100 inbound deny tcp 443 0.0.0.0/0 200 inbound allow tcp 443 0.0.0.0/0 100 outbound allow tcp 1024-65535 0.0.0.0/0
Common mistakes
These are the ones that fail silently. The config is accepted, nothing raises an error, and the consequence arrives later.
Adding an outbound rule for the service port
The reply goes to the client's ephemeral port, not back out through 443, so the rule covers nothing and the connection still hangs.
Instead:Add an outbound allow for 1024-65535.
Expecting an explicit deny to override an allow
Network ACL rules stop at the first match in number order, so a deny only wins if it is reached first.
Instead:Renumber so the specific rules come first, and leave gaps of a hundred.
Attaching a hand-made network ACL to a live subnet
A custom ACL starts with nothing but the implicit deny, so every connection stops the moment it is attached.
Instead:Add the rules first, then associate the subnet.
The reply does not go back out through the port it came in on
It goes to the client's ephemeral source port. So an outbound rule for 443 does nothing for a connection that arrived on 443, and the connection establishes and then stalls.
The range belongs to the client, not to you
Linux uses 32768-60999, Windows Server uses 49152-65535, and load balancers and NAT gateways use the whole of 1024-65535. Since you do not control the client, allowing 1024-65535 is the practical answer and narrower rarely pays.
It happens in both directions
An instance calling an external API on 443 receives the response on its own ephemeral port, so an inbound allow for 443 does not cover it. This is the one that breaks package installs and API calls from a private subnet.
A deny does not automatically win
Rules are evaluated in ascending number order and stop at the first match, so a lower-numbered deny shadows a higher-numbered allow and a later deny after an allow is dead. That is the opposite of an IAM policy, where an explicit deny always wins.
Leave gaps in the numbering
The convention is to number in hundreds so a rule can be inserted between two without renumbering everything. Renumbering an ACL in place is exactly the sort of change that takes a subnet offline for a moment.
The default ACL allows everything and a custom one denies everything
A VPC's default network ACL is invisible until somebody edits it. One created by hand starts with only the implicit final deny, so attaching it to a subnet blocks all traffic until rules are added.
Security groups are the opposite in every respect
Stateful, allow-only, and attached to interfaces rather than subnets. If both are in play, the ACL is the one that needs rules in both directions.
More aws tools
AWS IAM Policy Validator & Analyzer Valid JSON? And what does it grant? AWS IAM Policy Evaluator Is this actually allowed? AWS S3 Bucket Policy Analyzer Is this bucket actually public? AWS S3 Bucket Policy Generator Pick a pattern, get a safe policy AWS ARN Decoder Split it up, and check it is right AWS ECS Task Definition Analyzer Two roles, and they are not the same AWS S3 Lifecycle Policy Analyzer Minimum durations you still pay AWS S3 Presigned URL Decoder It dies with the session AWS Lambda Configuration Analyzer Memory is the CPU dial AWS SQS Visibility Timeout Calculator Six times the function timeout AWS EventBridge Pattern Tester Every leaf value is an array AWS DynamoDB Capacity Calculator Every index costs a write AWS Resource Name Validator A dot in a bucket breaks TLS AWS CLI Profile Analyzer The prefix rule is opposite AWS IAM Trust Policy Analyzer Account root means the whole account AWS Access Key ID Identifier AKIA never expires, ASIA does AWS STS Assume Role Command Builder Chaining caps at one hour AWS KMS Key Policy Analyzer The one AWS mistake with no undo AWS Security Group Analyzer They cannot deny anything