A company wants to block a specific range of malicious IP addresses from reaching all EC2 instances within a particular subnet. The rule must apply at the subnet boundary and evaluate traffic in a stateless manner. Which AWS component should the company configure to meet this requirement?