what is the difference between NAT gateway and ACL with blocked inbound traffic

user_8050208 0
Viewed 1721

I read about aws VPC and try to find any sense to use NAT. If I understand correctly, NAT is used when we have VPC with two subnets: public and private. And if we want to allow private subnet make requests to global network (for example for software updates), but block all inbound traffic - we can setup NAT in public subnet and connect this NAT with private subnet.

enter image description here

But in the same time we can just create ACL for private subnet and block all inbound traffic. So, it would be able to download software updates if it need.

So, if all above is true, why do we need NAT?

amazon-vpc amazon-web-services
1 Answers

A Network Access Control List (NACL) is stateless. This means the rules are enforced in both directions. Thus, in your scenario, traffic would be blocked in both directions.

In general, there should be no need to use a NACL. There are some appropriate uses (such as creating a DMZ), but these are rare.

You could, if you wish, put everything in a public subnet and simply use Security Groups to control access. This would work well because inbound and outbound rules can be configured separately. However, many people like the traditional concept of a private subnet to give an added sense of security.

user_1747770
Related