title: Amazon VPC NACL default rules evaluation order
body: <p>With my understanding, NACL (Network Access Control List) is the subnet firewall.</p>
  
  <p>I'm  trying to understand what are the defaults when creating a NACL:</p>
  
  <ul>
  <li>Rule #100 - all ports from all IPs are allowed by default, otherwise</li>
  <li>All is denied</li>
  </ul>
  
  <p>So, bottom line, is all allowed or denied? I know that according to AWS best practices, all access should be disabled by default.</p>
  
  <p><img src="https://i.stack.imgur.com/W5oQi.png" alt="Rules"></p>