0

I am learning AWS VPC where I am assigning NACL Inbound/Outbound Rules as below: Right now i am doing for All IPs

Rule #    Type           Allow/Deny
100       All Traffic    Allow
200       SSH            Deny
 *        All Traffic    Deny


Outbound
Rule #    Type           Allow/Deny
100       SSH            Deny
200       All Traffic    Allow
 *        All Traffic    Deny

I am wondering how my SSH is working as rule says lower number will be evaluated first, and in outbound rule i have denied SSH. Can anyone explain how the rule actually works in AWS?

0

Incoming SSH traffic is allowed because inbound rule # 100 (200 is practically ignored) and outgoing rule not matching already established SSH connection...


Based on AWS documentation :

Network ACLs are stateless, which means that responses to allowed inbound traffic are subject to the rules for outbound traffic (and vice versa).

  • Inbound rule

Based on what I see I think you have wrong order of the rules.

Rule #    Type           Allow/Deny
100       All Traffic    Allow
200       SSH            Deny
 *        All Traffic    Deny

This has simply no sense as you are allowing all traffic with rule 100 so rule 200 would not be utilized anytime (the traffic will be allowed already based on rule 100 so nothing will "remain" for rule 200). I think more sense has different order (in case you want to deny the ssh service:

Rule #    Type           Allow/Deny
100       SSH            Deny
200       All Traffic    Allow
 *        All Traffic    Deny
  • Outbound

Here is SSH traffic with lower rule # :

Rule #    Type           Allow/Deny
100       SSH            Deny
200       All Traffic    Allow
 *        All Traffic    Deny

This will deny traffic for SSH and for the rest it will be allowed...

Type SSH is traffic with port TCP/22 - this is usually used as destination port. In case you would contact SSH server you are connecting to TCP/22 but your source port is TCP/X where X is "randomly" (not really but for simplicity let say randomly) selected let say >10000.

Once the server replying to your connection the destination port is "your" TCP/X so the rule not necessary match this traffic...

Outgoing traffic with destination TCP/22 would be the connection which is initiated on the server with destination on some other device and not already established SSH connection.

0

You're allowing all traffic into your host, but denying ssh outbound from it.

To the best of my knowledge the NACLs don't do deep packet inspection. Which means protocols are simple aliases to their assigned ports.

Unless you're doing something really bizarre like trying to ssh from port 22, your inbound ssh session should be just fine.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.