I have an odd scenario that I'm not sure how to get around.

Normally this is doable with subnet ACL's - However they are not stateful. I need "reply" established packets to allow a return (like a typical firewall)

I have a public and private subnet. Public needs to reach out to the internet so I have outbound allowed to but I want to restrict outbound for specific subnets ( and for example)

I could of course set this easily in ACL since it allows 'deny' but it won't allow reply packets since it's not stateful.

Is the only option to control this with 'inbound' rules on the other internal subnets? That makes a lot more rules for our different networks when it would be much cleaner to just restrict it on the outbound.

Any ideas are welcome, including re-architecting the whole thing (this is greenfield)

The comment below asked to further clarify the environment needs, so here is the environment as it's being requested for me to build out:

Think of it like a local and DMZ:

  • Instances in public subnet cannot initiate new outbound connections into the private subnets 10.100.0/24.
  • Instances in private subnet can initiate new outbound connections into the public subnet (to ssh, deploy code, etc).
  • Public subnet needs to initiate outbound traffic to internet freely
  • Because of the limitations of ACL, if I block outbound from public > private, it will not allow return packets (since it's not stateful)

Right now the only thing I can think of is relying on iptables and windows firewall within the instances themselves which is possible but a lot harder to manage.

Another idea is deploying a software firewall within EC2 (more $$) that can allow/deny the traffic in a stateful way. Yet another machine to manage.

Another idea is to have security group denying traffic inbound from public subnet into private subnet that would have to be allowed on all instances within the private subnet. The problem is that security groups do not have deny rules. Again not ideal.

Either having stateful ACL, or allowing deny rules on security groups would solve the problem fully. Unfortunately neither are possible within current AWS infrastructure.

  • Can you not simply create NACL rules that provide for reply packets? If not, why not? Do you need to prevent them initiating connections? – Tim Sep 28 '17 at 17:17
  • What's the method to create ACL rule that allows only reply packets but not a "new" outbound packet? From what I understand it's "all or nothing" with ACL and it's stateless unlike a typical firewall. – emmdee Sep 28 '17 at 19:12
  • That's correct. My question was why do you need that? A firewall is just one part of a security setup. NACL or security group as firewall, you might have instance based firewalls, your web server should only respond to the requests you want it to, you might use a CDN like CloudFront as well, and you might use a WAF like the AWS WAF. A firewall is not a solution to all security problems, and you haven't described what you're trying to achieve, you've asked a question about one part of it. Please edit your question if you want to provide more information. – Tim Sep 28 '17 at 19:57

The solution seems very simple.

Instances in public subnet cannot initiate new outbound connections into the private subnets 10.100.0/24.

They already can't, unless you created inbound rules in the security groups on the instances in the private subnets to allow it.

If you did, then remove those rules, because they shouldn't be there.

The only traffic allowed by the inbound rules on the security groups for instances in the private subnet should be the traffic that needs to reach them. There is no valid "ease of administration" justification for running a network with a soft chewy center where everything is allowed by default, particularly when the source specification for security group rules can be either security group IDs or IP ranges. Allow access from whence access should be allowed, and nothing more.

| improve this answer | |
  • Well I think my question is the epitome of "overthinking it" as I was focusing only on "outbound" restrictions - You're absolutely right and I feel like an idiot :) – emmdee Sep 28 '17 at 23:41
  • lol. Happy to assist. – Michael - sqlbot Sep 28 '17 at 23:45

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.