AWS vpc从公共子网访问Internet

Question

I configured public subnet on my VPC and add some Security Groups and NACL roles... I notice that when I set on NACL these roles in the inbound section :

100 SSH (22) TCP (6) 22 0.0.0.0/0 ALLOW
200 HTTP (80) TCP (6) 80 0.0.0.0/0 ALLOW
300 HTTPS (443) TCP (6) 4430.0.0.0/0 ALLOW

I didn't got access to the internet !!! :(

unless I added this role in the inbound section: 400 ALLTraffic ALL ALL 0.0.0.0/0 ALLOW

(after adding this role, I succeeded to get internet access by running "yum update" for example...)

It is really necessary or I configured somethings wrong ?

Answer 1

• Security Groups are stateful and automatically allow return traffic.
• Network ACLs are stateless and require you to provide inbound rules.

This is why you could get access to the internet once you added the 400 ALLOW Network ACL rule.

Depending on your requirements, you may not need Network ACLs at all instead relying on the Security Groups alone.

--

AWS VPC Security Groups and Network ACLs have different but complementary behavior.

This documentation describes the difference in detail.

http://docs.aws.amazon.com/AmazonVPC/latest/UserGuide/VPC_Security.html#VPC_Security_Comparison