An Auto Scaling group of EC2 instances runs Application A behind a Network Load Balancer in the same subnet. On-premises systems cannot reach Application A on port 8080. Flow logs were reviewed and show rejected traffic. What explains the rejected connections?

The Network Load Balancer (NLB) is a Layer 4 load balancer that operates at the connection level. When a client connects to an NLB, the NLB establishes a connection with a target instance. For the return traffic, the target instance sends responses directly to the client. This means the client's source IP and port are preserved. If the on-premises systems cannot reach Application A, and flow logs show rejected traffic, it's likely that the subnet's Network ACL (NACL) is blocking the outbound return traffic from the EC2 instances to the on-premises client on an ephemeral port. NACLs are stateless, so both inbound and outbound rules must be explicitly allowed. The EC2 instances' security group is incorrect because security groups are stateful; if inbound traffic is allowed, outbound return traffic is automatically allowed. The Network Load Balancer does not use security groups, so that option is incorrect. While an on-premises ACL could block traffic, the flow logs showing rejected traffic within AWS point to an AWS-side issue, specifically the NACL.