# Exercise 2 — Stateless NACL Debugging

## Scenario

A subnet is protected by a stateless network ACL (in addition to each instance's stateful security group). A teammate configured the NACL with only these two rules, and now reports that instances in the subnet "can't download anything from the internet — outbound requests just hang."

```
NACL rules (stateless, evaluated in order, first match wins):
100  ALLOW  outbound  TCP  dst port 443   to 0.0.0.0/0
*    DENY   (implicit default — no other rules configured)
```

## Deliverables

1. **Diagnose the hang, precisely.** Using theory section 2's explanation of stateless filtering, explain exactly why an outbound HTTPS request from an instance in this subnet never completes, even though outbound port 443 is explicitly allowed. Be specific about which leg of the round trip is being dropped and why.

2. **Fix it, correctly.** Write the corrected NACL rule set that allows outbound HTTPS requests to complete. Note that TCP responses don't come back on port 443 at the client side — they come back to the ephemeral port the client's OS chose for the outgoing connection (typically somewhere in the 32768–65535 range) — so state the specific rule your fix needs, including its port range.

3. **Contrast with the security group layer.** The instance's own security group (stateful) already had `ALLOW outbound TCP 443` with no matching inbound rule at all, and this was NOT a problem for that layer. Explain why the identical-looking single rule is sufficient at the security-group layer but insufficient at the NACL layer, tying your answer directly to the statefulness distinction in theory section 5.

4. **General lesson.** State, in one or two sentences, the general rule for how many NACL rules a bidirectional flow like this requires, that would let you avoid this exact mistake next time.