- Now let's take a look
at network access control lists,
otherwise known as NACLs.
Security of our environment,
security of our networks
within AWS, is paramount.
One of the tools that we have
access to are network access
control lists.
These are like firewall rules,
but they are applied to a subnet
as a whole.
They're not applied
to individual EC2 instances,
but they're applied to the subnet,
no matter what EC2 virtual machines
or how many are in there.
Another thing to keep in mind
is that a network access control list
is stateless.
That means that if something comes
in as an initial connection
and then packets go out in response,
the network access control list
will not recognize those packets
as being in response.
So the side effect of that
is that we have to specify
both ingress and egress rules
in order for traffic to flow.
Now with NACLs, we can specify
both an allow or a deny.
They actually do default
to denying all, and of course,
we can override that
with our rules.
We're going to specify the protocol
being either TCP, UDP,
ICMP, or all traffic.
We will specify an IP range,
where traffic is coming from,
and a destination port range.
Let's say that we have an application
web server and this web server
needs to receive traffic
on port 80 and port 443.
So we're going to say that we're going
to allow these two ports
to come in from anywhere.
This would essentially apply
to the internet.
We don't know where they could
come from, they just need to be able
to allow anywhere.
We want to restrict port 22
from our corporate VPN.
So here we're going to specify
a much narrower range,
being 192.168/16.
So perhaps this is the range
of our corporate VPN.
Now if traffic is coming in
on port 80 or port 443,
it's important that response traffic
be able to go out.
Now typically in a web server use case,
that outgoing connection will be
on a different port.
It will go back on a port
somewhere on an ephemeral port
within a pretty wide range,
1024 through 65535.
So in order for the response traffic
to be able to leave the subnet,
we have to be sure that we allow
this range of ports,
being the ephemeral port range.
So again, network access control
lists are a very key tool
that we should be using
within virtual private cloud.
They're applied to a subnet
as a whole, and remember that
they're stateless, so we have
to specify ingress and egress rules.
So again, to reiterate this important
point that network access control lists
are applied to the subnet as a whole.
So in this particular example,
let's say that we have our
web servers here
and we have our databases
back here in another subnet.
So we can see that we have
our network access control list
applied, it's sort of like
you can imagine it like a firewall
around the entire subnet.
In that last slide,
we can see that port 80
is open from pretty much anywhere.
So traffic coming in on port 80
would be allowed to pass through.
Here it's allowed to pass
through the NACL.
Port 22 is not allowed,
but it is allowed from our VPN.
So as long as we come from a range,
192.168 range, then that port 22
traffic would be allowed
through the NACL
and into the subnet.
Now in the case of having database
servers in another subnet,
we would probably want a NACL
that allows port 3306 to come
in from our corporate VPN range,
perhaps 192.168 to come in,
but the NACL itself would block
all other attempts
or all other sources
on that particular port.
We might also even deny
and say that port 3306
is allowed through the NACL
from the range of our application
servers, but nowhere else.
If we had other subnets
in this particular VPC
that were being used
for different purposes,
then we might also want
to block port 3306
from those ranges
and only allow it from the range
of our application servers.
So again, network access control
lists, you can think of it
as a firewall for the entire subnet.
It prevents traffic from getting
into the subnet.
Then of course we have other means
that we'll talk about later on
as a means to limit the flow
of traffic on a per machine basis.