1

Everything works as expected. This question is for learning purposes only.
Using Amazon Security Groups in a VPC. Outbound rules are:
0.0.0.0/0 Port 80
0.0.0.0/0 Port 443

Iptables allows OUTPUT access to destination port 53.
-A OUTPUT -p udp --dport 53 -m state --state NEW,ESTABLISHED -j ACCEPT

Why don't I need a rule in the Security Group for Port 53?

  • What has Amazon told you about the matter? – gparent Dec 3 '14 at 21:33
2

I'm not sure how your testing, but if it is just via doing a DNS lookup, it might be this:

Amazon security groups and network ACLs don't filter traffic to or from link-local addresses (169.254.0.0/16) or AWS reserved addresses (the first four IP addresses and the last one in each subnet). These addresses support the services: Domain Name Services (DNS), Dynamic Host Configuration Protocol (DHCP), Amazon EC2 instance metadata, Key Management Server (KMS—license management for Windows instances), and routing in the subnet. You can implement additional firewall solutions in your instances to block network communication with link-local addresses.

http://docs.aws.amazon.com/AmazonVPC/latest/UserGuide/VPC_Security.html

From this I infer that DNS will continue to work in any event, and that doing a lookup from the command line should succeed. If you do so with verbose output, you should see a a local address on your subnet for the DNS server.

  • The Amazon default rule is 0.0.0.0/0 All Traffic meaning, by default, all outbound traffic is allowed. That default rule has been removed and replaced with the 2 outbound rules above. Shouldn't this only allow outbound traffic on 443 and 80 only? – csi Dec 3 '14 at 21:16
  • Okay. I see that by adding those two rules and removing the default 'allow everything' rule everything else should be blocked and my original answer is wrong. Anway, maybe this has something to do with it: docs.aws.amazon.com/AmazonVPC/latest/UserGuide/… look to the section where they talk about DNS and DHCP. – vjones Dec 3 '14 at 21:30

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.