Why do I need Ephemeral ports open for http 80 (website to work)?

1

Why do I need Ephemeral ports open for http 80 (website to work)?

Can someone please help me understand if I am creating a NACL why do I need Ephemeral ports on the outgoing for a http request to work?

profile picture
demandé il y a un an689 vues
4 réponses
0

NACLs are stateless, the response is not implicitly allowed therefore you need to explicitly allow the Ephemeral ports. On the other hand Security groups are stateful, you only would need to allow inbound access, return response would be allowed implicitly.

profile pictureAWS
EXPERT
répondu il y a un an
0

yea.. I am understand that that I have port 80 up inbound and also outbound..... just dont understand why I need the ephemeral ports open for http.. I would think if I have port 80 allow on the in and out it would work

profile picture
répondu il y a un an
0

For http the Request traffic is on port 80. Response traffic isn't on port 80, it's on one of the ephemeral ports. So for inbound connections your NACL needs to allow port 80 inbound but NOT outbound! Just the ephemeral ports outbound.

EXPERT
répondu il y a un an
0

Let's say I connect to your webserver, which is listening on port 80.

The TCP connection originates from a socket on my device, which is bound to an ephemeral port. It'll connect, say, TCP port 54785 on my Mac to port 80 on your webserver.

Stateful firewalls understand that the traffic sent from port 80 on your webserver to port 54785 on my machine represents a connection / conversation, so they don't need explicit rules to permit the traffic.

NACLs on the other hand are completely stateless, and have no concept of what has happened at any other point in time, much like an AWS service team building a way to run containers, oblivious of the countless other services that do the same thing. As a result, the traffic from port 80 to the ephemeral ports has to be explicitly permitted.

All of that said, the default best practice guidance on NACLs is "avoid them if at all possible." They're annoying to troubleshoot, and easy to forget they're there...

profile picture
répondu il y a un an

Vous n'êtes pas connecté. Se connecter pour publier une réponse.

Une bonne réponse répond clairement à la question, contient des commentaires constructifs et encourage le développement professionnel de la personne qui pose la question.

Instructions pour répondre aux questions