Four reasons a packet is dropped

Quick reference

Security group

• Stateful: the reply is allowed
• Allow rules only, no deny
• Checked at the network interface
• No matching rule means drop

Network ACL

• Stateless: each direction alone
• Ordered rules, lowest wins
• Needs an ephemeral-port rule
• Applies to the whole subnet

Missing route

• Longest prefix match decides
• No match means a drop
• Peering routes are not transitive
• Add the route on both sides

Blackhole

• Target deleted, route stayed
• State shows as blackhole
• Common after a NAT is removed
• The log may show ACCEPT, then silence

Explained

At the interface

Security group first. It is stateful, allow-only and evaluated at the network interface. If no rule allows the traffic, it is dropped, and the reply to an allowed connection is allowed automatically.

Network ACL second. It is stateless, ordered by rule number and attached to the subnet. Return traffic needs its own rule, which is why an inbound 443 rule without an outbound 1024-65535 rule produces a one-way connection.

On the path

Missing route third. Every subnet uses one route table; the longest prefix wins, and no matching route means a drop. There is no fallback to the default when nothing matches. Peering routes are not transitive and must exist on both sides.

Blackhole fourth. The route is still in the table but its target is gone, so its state turns to blackhole and the packet is dropped. A deleted NAT gateway or network interface leaves exactly this. The table still looks populated, which is why blackholes survive so many reviews.

In one line

Watch the drop

$aws ec2 describe-flow-logs