Hack the Route Start free Open app Containers and cloud networking
Security groups and network ACLs
The cloud's two firewalls: stateful allow rules on each instance, and stateless numbered rules on each subnet.
A security group is attached to an instance's card: allow rules only (by protocol, port and source, which may be another group), everything else denied, and stateful, so replies need no rule. A network ACL guards a subnet: numbered allow and deny rules read in order, and stateless, so replies need their own rule for the client's ephemeral ports (1024-65535 to be safe; Linux uses 32768-60999). That reply rule also admits new connections to high ports, so the fine filtering belongs in security groups and the ACL is a coarse backstop. Azure's network security groups (NSGs) are stateful and attach to subnets or cards.