An application developer has deployed a web server on an Amazon EC2 instance inside a public subnet. To control traffic, the developer associates a custom Network Access Control List (NACL) with the subnet. The developer adds an inbound rule allowing TCP traffic on port 80 from any IP address to reach the web server. However, external web clients are unable to load the webpage hosted on the server.
Which configuration change is necessary to allow the web clients to successfully establish a connection?
- AVerify that the Network Access Control List has a corresponding outbound rule for port 80, as the Network Access Control List will automatically handle the return traffic dynamically.
- BConfigure the outbound rules of the associated Security Group to allow traffic to ephemeral ports, as Security Groups are stateless by default.
- Add an outbound rule to the Network Access Control List that allows TCP traffic to ephemeral ports (1024-65535).Cevap
- DDeploy AWS WAF to bypass the Network Access Control List rules and handle the outbound session tracking.
Cevap
Add an outbound rule to the Network Access Control List that allows TCP traffic to ephemeral ports (1024-65535)
Network Access Control Lists are stateless, meaning that outbound response traffic must be explicitly allowed even if the inbound request was permitted. When a client initiates a connection to a web server (port 80), the server sends the response back to a random port in the client's ephemeral port range (typically 1024-65535). Therefore, an outbound rule allowing traffic to these ephemeral ports is required.
Adım Adım Çözüm
Anahtar Kavram
Network Access Control Lists are stateless firewalls at the subnet level, meaning that return traffic must be explicitly allowed via outbound rules, typically targeting the client's ephemeral port range.