I have a VPC with 3 subnets:
- Public (FE layer, inbound internet access only)
- Protected (app layer, outbound internet access only)
- Private (DB layer, no internet access at all)
The public subnet NACL blocks all inbound from the internet on any ports other than 443.
The private subnet NACL blocks all in and out from the internet.
The NACL for the protected subnet has to allow:
- outbound on 443 to 0.0.0.0/0 for outbound internet https requests
- inbound from 0.0.0.0/0 on 1024-65535 for responses to those requests
The protected subnet routes to the internet through a NAT Gateway, which lives in the public subnet.
The problem is this: outbound traffic from the protected subnet to the internet only works if the NACL for the public subnet is opened to allow inbound on ports 1024 - 65535. This is presumably because the traffic goes through the public subnet (since that's where the NAT Gateway lives).
So I can open up the NACL for the public subnet (inbound from 0.0.0.0/0 on 1024-65535), but that makes it less secure; in fact if I'm opening all those ports, I may as well just not bother with a NACL at all (obviously I am also using security groups).
Am I missing something?