Let's learn how to create NACL(Network Access control list)?

Create NACL
Name - Specify the name correctly
VPC - Select VPC correctly
Create
Now we need to attach this to the public subnet
Select NACL - Actions - Edit subnet associations - Select webSN assuming that this is Web Subnet where Web Server EC2 Instance is created.
SAVE

Now go to browser - PublicIP of WebServer EC2 Instance
The page doesn't load as expected because NACL blocks all the incoming connections
We need to open ports at the NACL
We need to open HTTP 80 port as we're accessing Web Server EC2 Instance from the browser.
We also need to open ssh 21
Go to NACL - Select NACL - Go to inbound rules
Add new rule
Add SSH & HTTP
SAVE

Now go to browser - PublicIP of WebServer EC2 Instance
The page doesn't load as expected

We need to understand stateful and stateless in nature
We need to open outbound ports explicitly
NACL is stateless

Select security group - webserver - We have both Inbound/Outbound
Go to Outbound - Edit
Add SSH & HTTP
SAVE

Now go to browser - PublicIP of WebServer EC2 Instance
The page doesn't load as expected

Even though the ports opened at Outbound, the web page doesn't load as expected.
Now we need to understand Ephemeral ports
Ephemeral means temporary
The total range of Ephemeral ports are 1024 to 65535

Go to inbound - Edit
Add Ephemeral ports are 1024 to 65535

Go to Outbound - Edit
Add Ephemeral ports are 1024 to 65535

For NACL, we need to apply rules at both Inbound & Outbound explicitly.

Now go to browser - PublicIP of WebServer EC2 Instance
The page should load as expected



We also need to understand what is stateful & stateless.
When we open an inbound port in the security group, the outbound port is open to all by default.
This status is called stateful.

For NACL, we need to open outbound port explicitly
NACL is stateless in nature

Reply Hide

Posted in: AWS | ID: Q54 |
August 04, 2021, 10:56 AM | 0 Replies