Security Groups are Stateful: If you open inbound port 80 to let a web browser access your EC2 instance, the response traffic traveling back out to that browser is automatically allowed, even if your outbound rules are completely empty.NACLs are Stateless: If you allow inbound port 80 in a NACL, you must also explicitly create an outbound rule to allow the response traffic out. Usually, you have to open up the ephemeral ports (1024-65535) on the outbound rule, or the browser will get a timeout error.