I have a very restricted ACL for my VPC. We have a public subnet and a private subnet, each subnet has its own individual ACL.

What I don't understand is why the following ACL works for sending email over port 465 via Amazon SES.


  • inbound: src, port 465
  • outbound: dest, port 465


  • inbound: N/A
  • outbound: dest, port 465

I get both outbound, but the inbound for public doesn't make any sense. Where in the SMTP RFC say the smtp server (SES, a relay) will connect with the client back on port 465? I would expect client pick a high port as shown in the following netstat:

tcp      104      0 ip-10-0-1-75.ec:36836 ec2-54-243-225-221.:urd CLOSE_WAIT
tcp        0      0 ip-10-0-1-75.ec:50903 ec2-54-243-161-229.:urd ESTABLISHED

urd is 465 from what I understand. So my instance in the private subnet routes the request to the NAT instance, and the NAT (in public subnet) sends the packets to the remote server. So why is 465 needed inbound anyway?

  • Please take your time to make the problem clear. If something works, then it's not a problem. What are you trying to do? No one needs an inbound port free for connecting to the same outside. – Diamond Jan 27 '16 at 8:50
  • @bangal if something works, and you don't understand it, that actually is a problem when it comes to security. – Michael - sqlbot Jan 27 '16 at 10:59
  • @Michael, well, it is, but that doesn't make a question understandable itself. Just as a ref: How do I ask a good question?, Explain what you're trying to do, and why. – Diamond Jan 27 '16 at 11:19
  • Agreed. In this case, there is a fairly significant amount of implicit context related to EC2 and VPC and how machines with private IP addresses have traditionally accessed the Internet in that environment. – Michael - sqlbot Jan 27 '16 at 11:33

To be sure we're clear, src port 465 refers to source IP but destination port.

The source of the traffic (CIDR range) and the destination (listening) port or port range.


What's interesting about the question is that what's "wrong" (that is, the source of the confusion) with the rule isn't the port at all, it's the IP range.

This rule is allowing your instances on private subnets to access your NAT instance (on the public subnet) so that the traffic can be forwarded from there to the Internet. It's actual purpose is not for allowing traffic from the Internet back in (though it is inadvertently doing something similar to that, allowing ingress traffic with destination port 465, which you don't want). The more correct rule would use the cidr block of your VPC (e.g. (or an appropriate subset) as source and the NAT machine or its subnet as destination.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.