I'm setting up a new subnet and following AWS's "Recommended Network ACL Rules for Your VPC": http://docs.aws.amazon.com/AmazonVPC/latest/UserGuide/VPC_Appendix_NACLs.html#VPC_Appendix_NACLs_Scenario_2

Inbound Rule number 140 Allows ports 1024-65535 for Ephemeral ports.

Rule details:
Source IP:
Protocol: TCP
Port: 1024-65535
Allow/Deny: Allow
Comments: Allows inbound return traffic from hosts on the Internet that are responding to requests originating in the subnet.

I understand what Ephemeral ports are, but wouldn't this rule also Allow connections to say, an application started by a user/admin within this port range? For example, is the previous rule, #130, in this example needed since the port it's opening (3389) will be covered by the broad Ephemeral port rule?

  • 1
    Note that it also says "This range is an example only." – Michael - sqlbot Nov 22 '17 at 23:25
  • True, but considering that you would have to open some ports for Ephemeral usage, the question stays the same, wouldn't those ports now be opened for all traffic and not just returning tcp request. – Paul Tader Nov 23 '17 at 16:55
  • No, because NACL does not override Security Groups. Traffic must pass both sets of rules. That's why NACL allows all traffic by default -- security groups deny all traffic by default. Security groups should be your primary access control mechanism. – Michael - sqlbot Nov 23 '17 at 18:56
  • Sorry, in trying to keep the original post short and to the point I deleted the design I'm working out. I'm trying a different approach by configuring detailed NACL's to cover most of what SG's would do and install lightly configured, opened SG's. So when troubleshooting connection issues you could essentially look at subnet ACL's knowing the the the SG's rules are relaxed to help speed troubleshooting. I think I'm trying to "re-invent the wheel". I see now that because of the need for Ephemeral ports, I really don't have luxury of creating liberal SG's. Thanks Michael. – Paul Tader Nov 24 '17 at 17:00
  • You'll discover over time that security groups make more sense, particularly because you can use a security group as a source traffic identifier, instead of an IP address, which means group A can reference group B as a source, which means any instance associated with group B (not the rules in B, but the actual instances associated with group B) can access the resources behind group A by reference rather than by IP. NACL is best reserved for things impossible to do with security groups, and you'll find that doesn't happen very often. – Michael - sqlbot Nov 24 '17 at 21:25

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.