How do I restrict internet access on WorkSpaces Personal?

Resolution

When you register a directory with WorkSpaces Personal, WorkSpaces creates a security group with the directoryidentifier_workspacesMembers naming convention. By default, this security group allows outbound traffic to all locations.

To restrict internet access from your WorkSpace, take one of the following actions.

Modify the security group rules to restrict internet traffic and allow only the following required Active Directory ports:

• TCP/UDP 53 - DNS
• TCP/UDP 88 - Kerberos authentication
• UDP 123 - NTP
• TCP 135 - RPC
• UDP 137-138 - Netlogon
• TCP 139 - Netlogon
• TCP/UDP 389 - LDAP
• TCP/UDP 445 - SMB
• TCP/UDP 464 - Kerberos password change
• TCP 636 - LDAPS (LDAP over TLS/SSL)
• TCP 3268-3269 - Global Catalog
• TCP/UDP 49152-65535 - Ephemeral ports for RPC

Modify the network access control list (network ACL) rules to restrict internet traffic and allow only the preceding Active Directory ports.

Use a network firewall, such as AWS Network Firewall, to block outbound internet traffic. A network firewall provides more granular control over traffic.

Related information

How can I access the internet from my WorkSpace?