An AWS network access control list (NACL) is an ordered, subnet-level rule set that allows or denies traffic entering or leaving a VPC subnet. Attach it to a subnet to control traffic between network layers, such as a public proxy subnet and a private backend subnet. section 1.2.2 section 5.5.3
Configure NACL rules with these operating principles:
- Treat NACLs as stateless: permitting inbound HTTP on port 80 does not automatically permit the response, so allow the relevant ephemeral ports from 1024 through 65535. section 5.5.2
- Assign rule priorities because a smaller rule number has higher priority; evaluation applies the first matching rule and skips the rest. section 5.5.2
- Remember that routing and filtering are separate: a private subnet without a route to an internet gateway cannot reach the internet, even when its NACL permits traffic. section 5.5.3
- Use NACLs alongside security groups, NAT, firewall rules, and route tables rather than treating them as replacements for the whole network design. section 1.2.2 section 5.1
Proxy and backend subnets
For a public proxy subnet, allow inbound HTTP from 0.0.0.0/0 and outbound ephemeral ports. For a backend subnet, allow inbound HTTP from 10.0.1.0/24 and outbound ephemeral ports to that proxy subnet. This limits backend access to the proxy layer while preserving the required request and response paths. section 5.5.2 section 5.5.3
NetworkAclEntryInPublicProxyHTTP: #1
Type: 'AWS::EC2::NetworkAclEntry'
Properties:
NetworkAclId: !Ref NetworkAclPublicProxy
RuleNumber: '110' #2
Protocol: '6'
PortRange:
From: '80'
To: '80'
RuleAction: 'allow'
Egress: 'false' #3
CidrBlock: '0.0.0.0/0'
NetworkAclEntryInPublicProxyEphemeralPorts: #4
Type: 'AWS::EC2::NetworkAclEntry'
Properties:
NetworkAclId: !Ref NetworkAclPublicProxy
RuleNumber: '200'
Protocol: '6'
PortRange:
From: '1024'
To: '65535'
RuleAction: 'allow'
Egress: 'false'
CidrBlock: '0.0.0.0/0'
NetworkAclEntryOutPublicProxyHTTP: #5
Type: 'AWS::EC2::NetworkAclEntry'
Properties:
NetworkAclId: !Ref NetworkAclPublicProxy
RuleNumber: '100'
Protocol: '6'
PortRange:
From: '80'
To: '80'
RuleAction: 'allow'
Egress: 'true' #6
CidrBlock: '0.0.0.0/0'
NetworkAclEntryOutPublicProxyHTTPS: #7
Type: 'AWS::EC2::NetworkAclEntry'
Properties:
NetworkAclId: !Ref NetworkAclPublicProxy
RuleNumber: '110'
Protocol: '6'
PortRange:
From: '443'
To: '443'
RuleAction: 'allow'
Egress: 'true'
CidrBlock: '0.0.0.0/0'
NetworkAclEntryOutPublicProxyEphemeralPorts: #8
Type: 'AWS::EC2::NetworkAclEntry'
Properties:
NetworkAclId: !Ref NetworkAclPublicProxy
RuleNumber: '200'
Protocol: '6'
PortRange:
From: '1024'
To: '65535'
RuleAction: 'allow'
Egress: 'true'
CidrBlock: '0.0.0.0/0'
Inspect the CloudFormation entries that encode rule numbers, protocols, port ranges, direction, actions, and CIDR blocks for a public proxy NACL. section 5.5.2
