I am implementing a REST service in Amazon AWS. The internal servlets listen on numerous ports like 8080 and 9000, and an Apache configured as a reverse proxy serves them with proper URL schema using https on port 443.
The Apache server handles users authentication and SSL security, while the internal ports serve all requests without authentication.
Naturally, I would like to block these internal servlets from getting traffic from the outside. I have installed a Network ACL and configured it using a permissive version of Amazon's guide: Inbound traffic for the ports 80, 443, 22 and 49152-65535 for return traffic, and outbound traffic allowed on all ports.
This configuration blocks outgoing traffic: for example, the Jenkins server can not fetch packages using pip or clone repos from github on port 22. The problem is solved when enabling ports 1024-65535 for inbound traffic, but that settings exposes the internal servlets.
Why are my outbound calls blocked? Can overcome this issue using a single VPC?