NACL - deny rules first, allow rules next

The evaluation of rules in security groups and network access control list are totally different.

In security groups, all the rules are evaluated before allowing a traffic.

Whereas in network access control list, it is done in the order of the rule number, that is, from top to bottom. If you set a rule which are allowe http traffic from a particular IP in rule number 99 and if you also set a rule number 100 which denies the http traffic from the same IP address, then the traffic from that particular IP address is not denied because rule #99 is executed prior to rule #100, that is, the rule on top (if you see in console) is executed first, then the below.

Hence in this case deny followed by allow is not actually denied whereas allow followed by deny takes the precedence that it is actually denied.

Thus in an NACL rule, it is always good to have the deny rules first and the allow rules next.

Tip: Write deny rules for specific ports. Example port 80.