7.5 Network Access Control Lists vs. Security Groups
Last updated
Was this helpful?
Last updated
Was this helpful?
Recap what we have now:
We have got an instance in a private subnet and an instance in a public subnet. We have deployed our NAT Gateway. We got two different security group one is to protect my private instance the other one is to protect my public instance. We only have one network ACL and this was created by default when we first provisioned our customized VPC. Basically, it allows all traffic in and out by default, and that is why we can go ahead and access this. Our public subnet and our private subnet are actually associated to this Network ACL. You can only associate a subnet to one network ACL. Go ahead and see our Network ACL in details.
Network Access Control Lists == Network ACL == NACL
Your Customized VPC == The VPC you created in 7.2 lab.
Go to VPC dashboard. Go to Network ACLs. Select the Network ACL of your customized VPC, and you can see the configurations in the Inbound rules tab, Outbound rules tab and Subnet Associations tab.
Click Create Network ACL. Name tag: MyWebNACL. VPC: your VPC. NACL can only be deployed into one VPC. They cannot span VPCs. Click Yes, Create.
For this newly created NACL, MyWebNACL, the Inbound rule is deny everything and the Outbound rule is also deny everything. It means by default, you create a private NACL.
Select MyWebNACL, and add rules of SSH, HTTP, HTTPS with source 0.0.0.0/0 to the Inbound rules. When you go to Outbound rules, you see it still deny automatically, this is because our network access control list is stateless. Unlike security groups, with security groups, when we go in and provision a rule, that is going to allow both inbound and outbound automatically. With NACL, you have to do it both. For the outbound rules, you add HTTP, HTTPS, and Custom TCP Rule (with ephemeral ports: 1024-65535) and all with destination 0.0.0.0/0. Using the ephemeral ports, let's say I'm trying to do a HTTP request to my web server through port 80 of the web server, but the information it is going to be transmitted back to me on a random port. Search "Ephemeral Ports VPC" on Google and learn more. For now, your NACL MyWebNACL is already, so go to associate subnets to it.
We want to associate our public subnet to MyWebNACL. But a subnet can only be associated to one NACL (just like one NACL can only be associated to one VPC). So when you associate the public subnet to MyWebNACL, it is automatically no longer associated with the default NACL of your customized VPC.
The inbound/outbound rules with smaller "rule #" of a NACL will have higher power than the rules with larger rule number. Therefore, for same "Type of rule", same "Protocol", same "Port Range" and same "Source/Destination", the actual result of allow/deny will depend on the allow/deny of the rule with the lowest rule number (Rules are evaluated starting with the lowest numbered rule). As soon as a rule matches traffic, it's applied immediately regardless of any higher-numbered rule that may contradict it.
With NACL, you can block the visit from a specific range of source IP through configure the inbound rules.
The NACL is more outside than Security group, so NACL access before security groups. So if you block inbound traffic at port 80 in NACL, even if you allow port 80 in security group, the NACL will block you first, so the security group doesn't even get to see this traffic, because NACL has already take care of it.
By default, when you add, remove or change Security Group rules, it will be applied in all instances which are associated with this Security Group immediately.
Your VPC automatically comes with a Default Network ACL, and by default it allows all outbound and inbound traffic.
You can create Custom Network ACLs. By default, each custom network ACL denies all inbound and outbound traffic until you add rules.
Each subnet in your VPC must be associated with a network ACL. If you don't explicitly associate a subnet with a network ACL, the subnet is automatically associated with the default network ACL.
You can associate a network ACL with multiple subnets; however, a subnet can be associate with only one network ACL at a time. When you associate a network ACL with a subnet, the previous association is removed.
Network ACL can span AZs, but obviously, subnets cannot. Each AZ can have multiple subnets, but each subnet can only map to one AZ.
Network ACLs contain a numbered list of rules that is evaluated in order, starting with the lowest numbered rule. As soon as a rule matches traffic, it's applied regardless of any higher-numbered rule that may contradict it.
Network ACLs have separate inbound and outbound rules, and each rule can either allow or deny traffic.
Network ACLs are stateless; responses to allowed inbound traffic are subject to the rules for outbound traffic (and vice versa). However, with Security Groups, I could just open port 80 and then that's it. There is no way to use a security group to block a specific IP address.
On your Network ACLs, do remember to allow ephemeral ports on your outbound rules only.
Blocking IP addresses uses Network ACLs, not Security Groups. Because inbound rules of SG tell you which addresses traffic are allowed, it is not make much sense of "blocking". You can also use firewalls to filter on source ports, but SG let your filter only on destination ports. In short, block the undesired traffic as early as possible regardless it is inbound or outbound.
Subnet is associated with NACL and Route Table, so NACL provides a subnet level traffic/access control. NACL is stateless.
Security Group is associated with EC2 instances, so SG provides an instance level traffic/access control. SG is stateful.
Security Group could be used as a whitelist, NACL could be used as a blacklist.
Some configurations:
Newly created customized Route Table doesn't have a route to outside Internet, i.e. 0.0.0.0/0->IGW, and only has a route within the VPC, i.e. 10.0.0.0/16->Local.
Newly created customized SG doesn't have any inbound rule, but has all traffic outbound rule.
Newly created customized NACL has a deny all traffic inbound rule and a deny all traffic outbound rule.
