Okay.
Hello cloud gurus and welcome to this lecture and this lecture we're going to look at network access
control list versus security groups.
So this is what our environment looks like right now we've got our NAT gateway sitting in 10 dot dot
one dot oh it's got a route out to the Internet and we've got our instances sitting in our private subnet
and it has a route pointing to the next Gateway which then has a route out to the Internet.
Let's go over to the obvious console.
So move it in the adobe us console.
Let's go over to services.
We're going to go over to our VPC.
We're gonna have a look at our network access control this in our VPC network access controls are under
security and we'll be able to see it out to network access control this and that both our default to
Nichols and one sits inside our custom VPC one sits inside our default BPC and they're associated by
two with two subnets and three subnets respectively sort of view our default narco just click on it
and you'll be able to see inbound rules and you'll see here we've got rule numbers now rule number one
hundred is for IPTV for because you can see the source in here and rule 1 0 1 is for IPTV 6 and Amazon
always recommend that you use increments of 100 so if you were to add another rule you would add for
IPTV for a rule number two hundred or four rule IPTV 6 you'd add.
Rule Number Two hundred and one of you do want to make it so you can see it a bit better just click
on this icon in here our outbound rules has similar things so a rule 100 Rule 1 0 1.
These are our allow rules.
These are our deny rules.
So in order to go ahead and start using network ACLU let's create a new network ACL I'm going to call
this my web all and we're going to select the VPC that it's gonna go in.
So I'm going to use the cloud guru custom BPC and I'm gonna go ahead and create it.
Now what do you think our new network ACL will look like in terms of its rules for click in here and
we can see or automatically the inbound and outbound rules is to deny everything.
So we're going to deny everything by default.
So remember that whenever you create a new network ACL you're going to deny everything.
Okay so let's go ahead and test this and we're gonna test this by setting up a web page on our web server.
So if we just go to over to easy to grab the public IP address of your web server we just need to log
into it and go ahead and install the patch and create a little web page.
So I'm actually still SSA HD into to my private database server and you can actually just type in exit
and then exit.
And that will take you back to your web server so you can see I'm now on a different IP address I'm
on 10 dot Oh Dot one dot 89.
So I'm on my public web server now and I'll just type in service hate TBD and then status to see if
it's in running.
And it hasn't even been installed.
So what I need to do is just type yum install and then hate TPD and then minus yes that will go ahead
and install hasty DPD then we want to go and I'll just clear the screen so it's easy to see so we want
to check config then hasty DVD and then on and then we want to run service TBD and then start that'll
start our service then or if we just go over to our city of dub dub dub each tier mill directory and
in here we can see that we don't have anything.
So all I'm gonna do is I'm going to just do this in nano actually so nano index dot h t amount we're
going to go ahead and create a little web page.
So I'm just going to type HCM now and then header and then hello cloud gurus and then I'm going to end
my head.
Then I'm going to end my hate here now and there we go.
So now all I'm going to do is exit.
Yes I'm going to save it and hit enter and if we do else we can see our index each Timo and if we cut
our index dot each terminal you'll be able to see the code inside it.
So back over in my calendar if I just type it in here I should be able to see our web page.
So there we go.
Hello cloud gurus.
Okay.
Some back in the Edelweiss console and the reason that that is working let's just go over to our VPC
section and go over to our network AC ls so that subnet is currently associated with our default subnet
and our default subnet has the inbound roll to allow everything.
So it's going to allow all traffic in here.
That's why each DDP can go through this subnet.
What we're going to do is we're going to move our subnet over to this network ACL and then we're going
to start experimenting.
So we just go into this network ACL and what we can do is click on subnet associations.
We can edit our subnet associations and we're going to add we're going to associate this subnet so tender
Oda 1.0 to this network ACL.
So I'm going to go ahead and hit edit and we can see that that is now associated with this subnet.
We click in here.
We can go back over to our default subnet and have a look and you can see now that it's no longer associated
with our default subnet.
It has now moved over to our Web network ACL.
And if I go back to my Web page and I refresh it's just you can see down here it says connecting.
It's just going to time out because currently we haven't set up this network ACL to allow each TTP traffic
to come through and you can see now it says this site can't be reached.
So we are now no longer able to access that Web site.
So how can we fix this.
Well we need to add some rules to allow us to be able to see each DDP.
We're going to click on edit inbound rules.
We're gonna start adding our rules must start with a rule 100 and they go up in increments.
One hundred and we're going to allow port 80 in from the source all addresses and then I'm going to
do the same with rule 200 except this time I'm going to allow each TTP support 443.
And then finally I'm also going to allow SS hate Shin.
So I'm going to allow port 22 and we're going to allow that in from the world.
So let's go ahead and hit save.
And now what these rules are doing is it's allowing us to connect in on port 80 port 443 and port 22
but it's only allowing inbound it's not allowing outbound.
So we need to go and add some outbound rules as well.
We're going to start with rule 100 and we'll get and allow port 80 in here and then we're going to add
a rule we're going to allow a rule 200 and then in here we're going to allow rule for port four for
three and then in here we're going to add our rule.
So we're going to add a third rule and this is where we add what's called our ephemeral ports.
And I'm going to explain what they are in a second but we're just going to type in here 1 0 2 4 and
then 2 6 5 5 3 5.
So those are our femoral ports.
I'm gonna go ahead and hit save.
So let's talk about what the femoral ports are so Wikipedia has a pretty good explanation here.
It talks about ephemeral ports is short lived.
Transport was transport protocol port for IP Communications and ephemeral ports are allocated automatically
from a predefined range by the IP stack software and then goes on to talk about servers.
So it says on servers ephemeral ports may be used as the port assignment on the server end of a communication.
So this is what's happening on our web server.
This is done to continue communications with a client that initially connected to one of the servers
well known as service listening ports so like port 80 or port 22 et cetera et cetera says here that
the allocations are temporary and only valid for the duration of the communications session after completion
or time out of the communication session.
The ports become available for reuse.
Down here it talks about the different ranges to use for ephemeral ports you might be wondering why
we use the Pacific range that we use.
And if you go over to the BPC documentation or include a link to this in the resources section of the
course you can read about ephemeral ports in here.
The reason we use the ports that we did is because in that Gateway uses ports 1 or 2 4 to 6 5 5 3 5.
So that's why we chose that port range.
So now I'm back on my little website.
If I hit refresh we get our web page.
So we have now associated our subnet to that network ACL and we've gone in and added our inbound rules
and our outbound rules and we are now able to connect to that over port 80 and we can see here we are
able to view our web page content some back in the VPC dashboard in here we can see our inbound rules
and we can see what's happening.
So the rules are being evaluated in order to rule 100 it is being evaluated before rule 200 and before
rule 300.
And that's the way it works.
And then it denies everything else.
So we're allowing in port 80 we're allowing in Port 443 we're allowing in Port 22 et cetera et cetera.
So what we could do is we could go in and edit our inbound rules and we can go in and add a denial.
So let's go in and add a deny rule for Port 400 and I'm going to deny port 80 and I'm going to deny
it to my specific IP address.
Second type what's my IP into Google and I'll give you IP address straight away.
So go ahead and copy that into a clipboard paste that in here and then I'm just going to do forward
slash 32 and I'm going to go ahead and change the allow to a deny and we'll see what happens.
So that is now denying my specific IP address through this security group.
And so now I'm on my Web page and if hit refresh.
I can still see the page.
So why is that.
Well rule 100 here is trumping rule 400 so rule 100 is allowing everything in on port 80.
It's not denying my specific IP address because my specific IP address as a rule 400 if to bear that
in mind with network ACL is that done in chronological order.
So if you've got a deny you have to have the deny before the allow some back here.
Let's go ahead and edit our inbound rules and we'll change this rule from Rule number 400 to rule number
ninety nine.
We'll go ahead and hit save.
So now we've got Rule Number ninety nine which is knowing my specific IP address and then it's allowing
all other IP address.
And so if I go ahead and hit refresh in here you can now see it says connecting and it's going to time
out because it is denying this specific IP address but it's allowing all other IP addresses in.
So this comes up an awful lot in the certified security specialty exam you need to understand how network
AC ls work and how the rules work.
And you can have a specific deny but if you've got no allow before the deny then that rule is not going
to work.
So you have to have a good understanding of that going into your exam.
So before we go on to my exam tips I just want to remind you of a few things we've learnt in this lesson.
So when we created our VPC a network ACL was created by default.
And it's called Our default network ACL.
And every time we add a subnet to our VPC it's going to be associated with our default network ACL.
You can then associate the subnet with a new network ACL but a subnet itself can only be associated
with one network ACL at any given time.
That being said network ACL can have multiple subnets on them.
So I could go in here and I could go and add a new subnet association.
So I could go and add this one so it can have many different subnets associated with our network ACL.
If we wanted and then of course as soon as we do that association and as soon as we make any rule changes
those rules take effect immediately.
And just remember that rules are evaluated in numerical order.
And if you have a deny first that's always going to deny even if you allow it later.
So you if you're going to deny a specific IP address you want that rule to be evaluated first.
Now this will come up an awful lot in the certified security specialty exam doesn't come up in the certified
solutions architect associate exam too much but it is a good thing to know in real life.
I remember that when you're using subnet a network ls they're always going to be evaluated before security
groups.
So if you deny a specific port on your network ACL is never even going to reach your security group.
So network ACL is always act first before security groups and so on to my exam tips and we're basically
just going to summarize everything I just said see a VPC automatically comes with a default network
ACL and by default it allows all outbound and inbound traffic and then you can create custom network
ACL but by default each custom network ACL denies all inbound and outbound traffic until you go ahead
and add rules and each subnet in your VPC must be associated with a network ACL.
And if you don't explicitly associate a subnet with a network ACL then the subnet is automatically associated
with the default network ACL and you cannot block IP addresses using network ACL.
You can't do this using security group.
So if you're always given the choice you use a network ACL to block specific IP addresses.
And just remember that you can associate a network ACL with multiple subnets.
You can have as many subnets in there as you want.
However a subnet itself can only be associated with one network ACL at a time.
And when you associate a network ACL with a subnet the previous association is removed and the network
ACL is contain a numbered list of rules that is evaluated in chronological order starting with the lowest
number rule first.
And network ACL is always have a separate inbound and outbound rules and each rule can either allow
or deny traffic and network ACL are stateless.
So responses to allowed inbound traffic are subject to the rules for outward bound traffic and vice
versa.
So you need to go in and add rules both inbound and outbound with security groups that are state for
you don't need to do that but just by allowing inbound it automatically allows outbound as well.
So that is it for this lecture everyone.
Hopefully you understand network ACL is in a lot more detail now in the next lecture we're going to
cover off custom BPC is an elastic load balancers so if you've got the time please join me in the next
lecture.
Thank you.