- Here let's review a demo of creating and applying
a network access control list to an existing subnet
within VPC.
So again we're back in the AWS console,
in the VPC Dashboard.
I'm filtered by the VPC that I wanna work with our 10.2/16.
We have created some subnets as we can see here.
We have created some route tables and internet gateways.
We have traffic routed to and from the internet.
But now we wanna tighten security around
those public subnets.
Perhaps those public subnets are meant to house
a web server.
We don't need port 22 open, we wanna put some guard rails
around that subnet, so that the subnet as a whole
is protected from system ports like port 22 and so on
from being accessed from the internet.
So I'm gonna come down here to network ACLs.
You can see that we get a default NACL.
Where all traffic is allowed,
both inbound and outbound.
Now from here I want to create a new network ACL.
I'm going to create a new one, I'm gonna call this one
public, or perhaps web traffic.
Again I wanna make sure that we're using the right VPC.
Now that it's created, I need to associate that
network access control list with the subnets
on which I want to control ports.
So here I'm going to edit.
I'm going to associate this with both of our public subnets.
I'm gonna hit save.
Now that we have our network access control list associated
with our subnets, we can go back and start to modify
our inbound rules.
Again, you can see that because this was not the default
NACL that came with the VPC,
it's defaulting to denying all traffic,
both inbound and outbound.
So, now that this particular NACL is associated
with our subnets,
no traffic can enter or leave those subnets.
So, the first thing that I wanna do,
considering that this is meant for a web application.
For inbound traffic, I want to allow,
I'm going to say, I'm going to start with rule
number 100, and I'm going to choose
HTTP traffic or port 80.
Which is TCP port 80.
And I'm going to allow that from the internet
using all zeros.
I'm going to add another rule, 101,
being HTTPS here.
Which is TCP port 443, and again from the internet.
And I'm going to save those two rules.
Now you can see that those packets are allowed
into our NACL.
And all other traffic is still denied.
So port 22, port 21, whatever, all other ports are denied.
Now, as we've talked about network ACLs are stateless.
We have to create both inbound and outbound rules.
At this point our web server would be able to receive
a connection on port 80 or 443,
but the response traffic would not be able to get out.
You can see here that outbound or egress rules
are still being denied.
So from here, we don't really need these machines,
these web servers, to initiate connections on
port 22, 4SSH, or port 21 for FTP,
that's not their purpose.
So we're going to allow ephemeral ports.
I'm gonna say rule number 100 will allow all TCP
on port 1024-65535, that is essentially in all practical
reality, that is the ephemeral port range.
And we're going to say that those port ranges
are allowed to go out to anywhere because we're going
out to the internet.
We are allowing that range.
I'm going to go ahead and save that.
And now you can see, we have created
a network access control list.
We've associated it with our two public subnets.
We have allowed port 80 and 443 to come in,
and we have allowed the ephemeral port range to go out.
And that is how we create
and associate network access control lists within AWS VPC.