Using NACLs
NACLs are an important, yet often overlooked, part of VPC security. While security groups tend to be the focus of most AWS users due to their versatility and ease of use, NACLs provide an additional layer of security and should be considered in a defense-in-depth approach. They operate at the subnet level, providing a rule-based system for controlling inbound and outbound traffic across all AWS resources within a subnet. In this section, we will delve into some of the significant aspects of NACLs that are particularly relevant for advanced AWS users and highlight some common mistakes to avoid.
Significant aspects
Let’s explore some of the features that distinguish NACLs:
- Stateless filtering: Unlike security groups, which are stateful, NACLs are stateless. This means that they evaluate both the request and the response traffic independently against the rule set. Therefore, for two-way communication, both the request and the response traffic must be explicitly allowed in the NACL rules. This differs from security groups where an allowed outbound request automatically allows the inbound response.
- Rule numbering: NACLs use rule numbers to identify rules. These numbers are important because they determine the order in which rules are evaluated, with lower-numbered rules evaluated before higher-numbered rules. This allows you to create granular rules that can override broader ones, a feature not available in security groups where rules are evaluated collectively.
- Rule action: NACLs offer a distinct advantage over security groups in terms of rule actions. While security groups only support allow rules, NACLs can accommodate both allow and deny rules. This dual functionality provides a greater degree of control over resource access. Given that NACLs affect an entire subnet, they become an optimal tool for swiftly blocking traffic from a specific IP address. This can be particularly useful in automated response scenarios where you need to programmatically block an IP address exhibiting suspicious activity.
Common mistakes
While NACLs offer an extra layer of security, they can also introduce risks if misused:
- Not using NACLs in addition to security groups: While security groups can provide robust security at the instance level, NACLs add an additional layer of security at the subnet level. Not using NACLs in addition to security groups can leave your resources more vulnerable. Furthermore, some compliance benchmarks, such as the CIS AWS Foundations Benchmark, recommend the use of NACLs in addition to security groups.
- Forgetting the existence of blocking NACL rules: Since NACLs are not as commonly used as security groups, their existence is often forgotten when troubleshooting connectivity issues. This can lead to confusion and wasted time if a connectivity issue is due to a blocking rule in an NACL that was created long ago or by another user in the same AWS account.
- Overly permissive rules: One common mistake for any firewall-like security mechanism is to create overly permissive rules that allow more access than necessary. This can expose your resources to unnecessary risks. Always follow the principle of least privilege when creating NACL rules, just as you would with security groups.
- Not considering rule order: The order of rules in an NACL is important because rules are evaluated in order starting with the lowest numbered rule. Not considering rule order can lead to unexpected results. For example, if you have a rule numbered 100 that allows all traffic and a rule numbered 200 that denies traffic from a specific IP address, the deny rule will never be evaluated because the allow rule will match first.
- Ignoring ephemeral ports: When creating rules for outbound response traffic, it is important to consider ephemeral ports. These are temporary ports that are assigned by the client’s OS for TCP and UDP responses. If these ports are not allowed in your outbound rules, response traffic will be blocked. This is a consideration unique to NACLs due to their stateless nature.
- Not regularly reviewing NACL rules: Just like with security groups, it is important to regularly review your NACL rules to ensure they still meet your needs. AWS Config can be used to monitor your NACLs and alert you to any changes.
In conclusion, while NACLs may not be as commonly used as security groups, they are an important part of a comprehensive security strategy. By understanding their significant aspects and avoiding common mistakes, you can use NACLs effectively to enhance the security of your network traffic in your VPCs.