1

I am implementing a REST service in Amazon AWS. The internal servlets listen on numerous ports like 8080 and 9000, and an Apache configured as a reverse proxy serves them with proper URL schema using https on port 443.

The Apache server handles users authentication and SSL security, while the internal ports serve all requests without authentication.

Naturally, I would like to block these internal servlets from getting traffic from the outside. I have installed a Network ACL and configured it using a permissive version of Amazon's guide: Inbound traffic for the ports 80, 443, 22 and 49152-65535 for return traffic, and outbound traffic allowed on all ports.

enter image description here

This configuration blocks outgoing traffic: for example, the Jenkins server can not fetch packages using pip or clone repos from github on port 22. The problem is solved when enabling ports 1024-65535 for inbound traffic, but that settings exposes the internal servlets.

Why are my outbound calls blocked? Can overcome this issue using a single VPC?

|improve this question
  • 1
    Why are you trying to do this with Network ACLs, which are stateless, instead of Security Groups, which are stateful? – Michael - sqlbot Feb 11 '14 at 23:10
  • Because I want port 8080 to be available only from inside my VPC, but not from outside. If I close this port using a SG, other computers on the VPC won't be able to access it. – Adam Matan Feb 12 '14 at 9:03
  • Sorry... that does not make sense. Security groups are only comprised of "allow" rules, so you don't use them to "close" ports -- you use them to "open" ports... in this case, you would configure the security group to open (allow) access to that port only for hosts within the VPC, which you can specify either by source IP or by the source sg-xxxxxxxx identifier... whatever you don't allow, inbound, in a security group, is denied... but TCP return traffic is automatically, implicitly allowed, because the SG understands that the instance originated the traffic... because they're stateful. – Michael - sqlbot Feb 12 '14 at 10:13
  • I thought that a network ACL might serve as a second protection layer. – Adam Matan Feb 12 '14 at 12:38
-1

The Amazon Firewalls don't support TCP states? That's new and disturbing information to me....

With no clear access to TCP states.. I'd say open the ports 1024-65535 on the Amazon ACL and use the local (system/iptables/windows firewall) firewall to limit the specific internal ports...

Alternatively just enable everything above port 10,000 at the amazon firewall...

If those are the only options the amazon firewall is offering... I would definitely add in the system level firewall to keep everything tight.

|improve this answer
  • Don't let it disturb you... ACLs are stateless by design, but they are the second layer of filtering -- the first layer (Security Groups) is stateful. – Michael - sqlbot Feb 11 '14 at 23:13
  • suppose i am just used to reading our net-admin's cisco ACLs which do seem to allow state aware statements. – Daniel Widrick Feb 12 '14 at 0:13

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.