SSH deny rule is allowing me to SSH? - amazon-web-services

I am learning AWS VPC where I am assigning NACL Inbound/Outbound Rules as below: Right now i am doing for All IPs
Inbound
Rule # Type Allow/Deny
100 All Traffic Allow
200 SSH Deny
* All Traffic Deny
Outbound
Rule # Type Allow/Deny
100 SSH Deny
200 All Traffic Allow
* All Traffic Deny
I am wondering how my SSH is working as rule says lower number will be evaluated first, and in outbound rule i have denied SSH. Can anyone explain how the rule actually works in AWS?

Actually it does not make much sense to me to open all ports on your server. I would try this approach and add for example the ports you need in order - here 443 (if needed) :
Inbound
Rule # Type Allow/Deny
100 443 Allow
* All Traffic Deny
Outbound
Rule # Type Allow/Deny
100 443 Allow
* All Traffic Deny
But be aware that the ACL in AWS is a stateless firewall. Every request (inbound or outbound) is treated as independent connections.

Typically, it is recommended that you leave the NACLs at their default settings (allow all). They should only be used for subnet-level security, such as creating DMZs.
Security Groups should normally be used to control access on ports. Security Groups are stateful, which makes things easier too.

Related

Outgoing rule based on host in AWS

I have an app that requires connecting to port 587 of Google's stmp servers in the domain stmp.gmail.com.
I want to create an outbound security rule that allow that specific traffic and nothing else, but the problem is AWS security rules only allow CIDR filtering (i.e. static IP address).
What is the combination of AWS services and configurations to make this happen?
I think you'll need to allow traffic to all the IPs; by default security groups allow ALL outgoing traffic - 0.0.0.0/0 destination: https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ec2-security-groups.html
You can restrict this to allow only 587 port but you cannot use DNS name directly.
You can check these resources to find more info:
https://forums.aws.amazon.com/thread.jspa?threadID=123159
Can I add dns name in aws security group

Does a curl/wget request respond on a random ephemeral port?

When I was setting up VPC in aws, I had created an instance in public subnet. The instance was not able to ping to google and was giving timeout when connecting to yum repository.
The security groups were open with required ports.
When I edited the ACL to add ICMP from 0.0.0.0/0 in inbound the instance was able to ping to google. But the yum repository was still was giving timeout. All the curl/wget/telnet commands were returning error. Only ping was working.
When I added the following port range for inbound in ACL 1024-65535 from all 0.0.0.0/0 that is when the yum repository was reachable. Why is that?
The outbound traffic was allow all in ACL. Why do we need to allow inbound from these ports to connect to any site?
In AWS, NACLs are attached to subnets. Security Groups are attached to instances (actually the network interface of an instance).
You must have deleted NACL Inbound Rule 100, which then uses Rule *, which blocks ALL incoming traffic. Unless you have specific reasons, I would use the default rules in your NACL. Control access using Security Groups which are "stateful". NACLs are "stateless".
The default Inbound rules for NACLs:
Rule 100 "ALL Traffic" ALL ALL 0.0.0.0/0 ALLOW
Rule * "ALL Traffic" ALL ALL 0.0.0.0/0 DENY
Your Outbound rules should look like this:
Rule 100 "ALL Traffic" ALL ALL 0.0.0.0/0 ALLOW
Rule * "ALL Traffic" ALL ALL 0.0.0.0/0 DENY
When your EC2 instance connects outbound to another system, the return traffic will usually be between ports 1024 to 65534. Ports 1 - 1023 are considered privileged ports and are reserved for specific services such as HTTP (80), HTTPS (443), SMPT (25, 465, 587), etc. A Security Group will remember the connection attempt and automatically open the required return port.

AWS network ACL: why do I need to allow outbound port 80 to be able to browse Internet?

I am very new to AWS and networking. I have been playing with network ACL. I realized that if I don't allow outbound port 443 (HTTPS) on the network ACL, I wouldn't be able to use a browser to go to https://www.google.com from within the EC2 instance in the subnet associated with this ACL.
Likewise, if I don't allow outbound port 80, I wouldn't be able to go to http://www.cnn.com.
This confused me. When I allow port 80 outbound on the ACL, am I allowing the EC2 to talk to port 80 on the CNN server, from an ephemeral port on my EC2, or am I allowing the EC2 to initiate a connection from port 80 on the EC2?
use the security groups at instance level to have security at instance level.And unlike security group, ACL is stateless and works at subnet level i.e if you want your instances to communicate over port 80(http) then you have add an inbound and outbound rule allowing port 80.
You don't have to add any rules. The default network ACL is configured to allow all traffic to flow in and out of the subnets to which it is associated. Each network ACL also includes a rule whose rule number is an asterisk. This rule ensures that if a packet doesn't match any of the other numbered rules, it's denied. You can't modify or remove this rule.
Rules allow all IPv6 traffic to flow in and out of your subnet. We also add rules whose rule numbers are an asterisk (Catch All) that ensures that a packet is denied if it doesn't match any of the other defined numbered rules.
A network ACL has separate inbound and outbound rules (Stateless), and each rule can either allow or deny traffic.
Out Bound Rules allow outbound traffic from the subnet to the Internet. In other words it is matching the traffic flow with the defined rules in the ACLs list and apply it (ALLOW/DENY).
If you have private instances that should not be accessible by public users in the internet it is best practice from security point of view to place these instances in a private subnet and use NAT instance in a public subnet and make all traffic flow goes through this NAT instance to make patch updates and get the public access.
For more information, Check Amazon Docs

Can't connect out from my EC2 instance unless allow all traffic inbound

I have an issue where my linux EC2 instance can't do anything outbound(ping, curl, yum update, wget, traceroute, etc..) unless I have a rule in my VPC ACL inbound rule set that allows all traffic.
My security group and VPC both have outbound rules that allows all traffic to everything.
The security group inbound list attached to the instance looks like this:
And the VPC inbound list looks like this(rule 200 is the one I'm talking about):
If I delete the inbound rule that allows all traffic(rule 200), then I can't do anything outbound.
Could there be anything that I'm missing ? Thanks!
ACL rules are stateless, which means they don't keep track of your outbound connections when evaluating inbound connections. So if you make an outbound connection to a server, the ACL rule will block that server's response unless you have explicitly allowed inbound connections from that server in the ACL.
This is one of the primary reasons that most people only use Security Groups (which are stateful) instead of ACL rules. Looking at your network ACL rules, there is nothing happening there that isn't already covered by your Security Group rules, so why use ACLs?

AWS vpc access the Internet from public subnet

I configured public subnet on my VPC and add some Security Groups and NACL roles... I notice that when I set on NACL these roles in the inbound section :
100 SSH (22) TCP (6) 22 0.0.0.0/0 ALLOW
200 HTTP (80) TCP (6) 80 0.0.0.0/0 ALLOW
300 HTTPS (443) TCP (6) 4430.0.0.0/0 ALLOW
I didn't got access to the internet !!! :(
unless I added this role in the inbound section:
400 ALLTraffic ALL ALL 0.0.0.0/0 ALLOW
(after adding this role, I succeeded to get internet access by running "yum update" for example...)
It is really necessary or I configured somethings wrong ?
Security Groups are stateful and automatically allow return traffic.
Network ACLs are stateless and require you to provide inbound rules.
This is why you could get access to the internet once you added the 400 ALLOW Network ACL rule.
Depending on your requirements, you may not need Network ACLs at all instead relying on the Security Groups alone.
--
AWS VPC Security Groups and Network ACLs have different but complementary behavior.
This documentation describes the difference in detail.
http://docs.aws.amazon.com/AmazonVPC/latest/UserGuide/VPC_Security.html#VPC_Security_Comparison