Connecting to an EC2 instance with custom FW rules

Question

I created a VPC with one Public subnet. Internet gateway was created and attached to the route table associated with Public Subnet. Linux EC2 instance was launched in the public subnet of the VPC under a new security group. EIP was created and attached to the instance.

Security Group:

Inbound Rule: ( Keeping only 1 inbound rule was intentional )

Type | Port | Source  
-----------------------
SSH  | 22   | 0.0.0.0/0

Outbound Rule:

Type  | Port | Destination
--------------------------
HTTP  | 80   | 0.0.0.0/0
HTTPS | 443  | 0.0.0.0/0

NACL:

Inbound Rule:

Rule | Type   | Port        | Source  
---------------------------------------
100. | SSH    | 22          | 0.0.0.0/0
101. | HTTP   | 80          | 0.0.0.0/0
102. | HTTPS  | 443         | 0.0.0.0/0
103. | Custom | 32768-65535 | 0.0.0.0/0

Outbound Rule:

Rule | Type   | Port        | Destination
-----------------------------------------
101. | HTTP   | 80          | 0.0.0.0/0
102. | HTTPS  | 443         | 0.0.0.0/0
103. | Custom | 32768-65535 | 0.0.0.0/0

I am unable to access instance with the above FW configuration. When I modify the NACL outbound and inbound rules and allow all traffic to pass through, I am able to access the instance.

I do not understand what is wrong with my initial configuration.

Answer 1

Network ACLs are stateless therefore you will need an outbound rule too

Security Groups on the other hand are stateful, therefore the return connection is permitted by default

Answer 2

Could you try adding an outbound NACL to port 22 and see if that works.

Depending on how you have things configured, you may need that.