I created a VPC with one Public subnet. Internet gateway was created and attached to the route table associated with Public Subnet. Linux EC2 instance was launched in the public subnet of the VPC under a new security group. EIP was created and attached to the instance.

Security Group:

Inbound Rule: ( Keeping only 1 inbound rule was intentional )

Type | Port | Source  
SSH  | 22   |

Outbound Rule:

Type  | Port | Destination
HTTP  | 80   |
HTTPS | 443  |


Inbound Rule:

Rule | Type   | Port        | Source  
100. | SSH    | 22          |
101. | HTTP   | 80          |
102. | HTTPS  | 443         |
103. | Custom | 32768-65535 |

Outbound Rule:

Rule | Type   | Port        | Destination
101. | HTTP   | 80          |
102. | HTTPS  | 443         |
103. | Custom | 32768-65535 |

I am unable to access instance with the above FW configuration. When I modify the NACL outbound and inbound rules and allow all traffic to pass through, I am able to access the instance.

I do not understand what is wrong with my initial configuration.


Network ACLs are stateless therefore you will need an outbound rule too

Security Groups on the other hand are stateful, therefore the return connection is permitted by default


Could you try adding an outbound NACL to port 22 and see if that works.

Depending on how you have things configured, you may need that.

  • Thanks Chris for the suggestion. I retried and my existing configuration worked magically without having any changes made to any rules. So I understood, any custom rules setup at the NACL will need similar rules defined at the SG level. ICMP In/Outbound rule defined at NACL will need similar rule defined at SG to enable ICMP traffic to be sent from the instance. – Amit Baid May 14 '18 at 6:57

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.