I have an odd scenario that I'm not sure how to get around.
Normally this is doable with subnet ACL's - However they are not stateful. I need "reply" established packets to allow a return (like a typical firewall)
I have a public and private subnet. Public needs to reach out to the internet so I have outbound allowed to 0.0.0.0/0 but I want to restrict outbound for specific subnets (10.100.1.0/24 and 10.150.2.0/24 for example)
I could of course set this easily in ACL since it allows 'deny' but it won't allow reply packets since it's not stateful.
Is the only option to control this with 'inbound' rules on the other internal subnets? That makes a lot more rules for our different networks when it would be much cleaner to just restrict it on the outbound.
Any ideas are welcome, including re-architecting the whole thing (this is greenfield)
The comment below asked to further clarify the environment needs, so here is the environment as it's being requested for me to build out:
Think of it like a local and DMZ:
- Instances in public subnet 10.200.0.0/24 cannot initiate new outbound connections into the private subnets 10.100.0/24.
- Instances in private subnet 10.100.0.0/24 can initiate new outbound connections into the public subnet (to ssh, deploy code, etc).
- Public subnet needs to initiate outbound traffic to internet freely
- Because of the limitations of ACL, if I block outbound from public > private, it will not allow return packets (since it's not stateful)
Right now the only thing I can think of is relying on iptables and windows firewall within the instances themselves which is possible but a lot harder to manage.
Another idea is deploying a software firewall within EC2 (more $$) that can allow/deny the traffic in a stateful way. Yet another machine to manage.
Another idea is to have security group denying traffic inbound from public subnet into private subnet that would have to be allowed on all instances within the private subnet. The problem is that security groups do not have deny rules. Again not ideal.
Either having stateful ACL, or allowing deny rules on security groups would solve the problem fully. Unfortunately neither are possible within current AWS infrastructure.