Hi, everyone, and welcome back.
Now in today's video, we'll be discussing about one of the important security functionality that E.W.
Sprouts, which is the network access control lists.
So at a high level overview of our network, see, it is basically an optional layer of security for
your VPC that acts as a firewall for controlling the traffic in and out of one or more subnets.
Now, when we discuss about firewall, we know the basics of security group and how security group works
or how we add the IP addresses in the security group rules that needs to be allowed in the overall connection
to the EC2 instance.
So when we discuss about firewalls, enablers, specifically at the network layer point of view, there
are two types of firewalls that are available for us.
One is the security group, and second one is that network.
You see it.
Now the primary difference between both of them is that the security group works at easy to instance
level.
So whenever you create a security group, you associate that security group with easy to instance.
So this is one type.
Second type is a network ACL.
Now, network ACL does not directly get associated with the easy two instance, but you can associated
at a subnet level.
For example, if you have a VPC which has multiple public private subnets, then you associate the network
ACL at the entire subnet level.
Now again, let's go ahead and understand this in a much more better way with a simple use case.
So we have a use case where a company X, Y or Z is getting a lot of attacks from a specific IP.
So this is one of the IP addresses from lead to huge amount of attacks are coming.
No company has more than 500 servers and the security team has decided to block this specific IP address
in the firewall for all of their servers.
Now, the question is, how can we go ahead and achieve the goal?
Now, when we discuss about security group, do note that in security group we only specify what are
the IP addresses that are allowed to the easy do instance.
We cannot really specify what are the IP addresses that are blocked.
For example, let's say that you have one of the EC2 instance that is hosting a website known for website
hosting.
You need to allow particular port four for three for the in database.
If you do not allow that port for the entire world, then people will not be able to visit the website.
So considering that the port, it is a load for doing database and there is one attacker who is taking
big advantage of attacking your server, you have to allow instead of one, but you have to block this
specific IP.
So in order to achieve this use case network ACL is one of the great solutions.
So as we are discussing network, you see it when you create you can associated at the subnet level.
So let's say you have a public subnet and a private subnet eat subnet has 250 set of easy two instances
so to 15 public to 50 in private.
So now what are you going to do in order to achieve this goal?
In the network ACL, you can specify a denial rule with the IP addresses of the attacker.
So you have DNA followed by the IP address.
And since this network ACL is connected to both the public and private to the traffic that comes to
any of these easy to instances that are part of these subnets, these traffic will be allowed or denied
based on network ACL as well.
So since network ACL is denied, any traffic coming to any easy to or any resources in this subnet will
be blocked considering that it is the IP addresses in the denied condition.
So this is the basic of what network equals.
And let's quickly have a quick demo.
All right.
So currently for today's demo, I have an easy two instance that is running in one of the reasons.
Now, if you look into this easy to instance in this security, let's go a big dump.
So there is a security group over here and in the inbound rules, it is basically allowing all the traffic
to connect to the instance.
So this is perfectly fine.
So let's do one thing.
Let's go ahead and verify if we are able to bring this specific easy to instance.
So let's do a ping and I'll specify the IP address.
And as expected, the ping is working perfectly well.
So let's figure a simple use is very what we want is we want everyone to connect to this, easy to instance
except one specific IP address.
So as we are discussing except one specific IP address, everyone should be able to connect to the EC2
instance.
Now, in order to achieve that, you cannot directly make use of a security group rule.
So what will be doing will be making use of a network.
And now if will quickly go to the VPC service, let's quickly open this up.
Now in the VPC console, currently, if you look into the VPC that is available, so only a default
to Ipxe available.
And if you look into this subnet, there are multiple subnets that are available.
Each one is associated with the.
A specific availability zone.
So if we'll go a bit on the right hand side, you see each subnet is associated with a specific availability
zone anyways.
This is not the thing that we're looking for.
So if you go big down under security, there is the option of network C as let's quickly open this up.
Now you see that there is one network ACL that is created and it's states associated with four subnets.
Now, as we were discussing, a network ACL can be associated at the subnet level.
So this network ACL is associated with four subnets.
And if you look into this VPC, this specific VPC or area, it has in total of four subnets.
So you can essentially see that the network ACL is associated with saying data VPC.
Now, if you look into the network ACL, again, similar to the security group, you have inbound and
outbound rules.
If you click on in modules, you will see that there are two rules that are available.
One is the allow rule, and second one is their denial.
So let's do one thing.
Let's go ahead and edit the inbound Lulu area.
So our point is to go ahead and block a specific IP address.
So if I quickly do a may be this is the IP address that I have.
Let's copy this up.
So let's do one thing.
Let's go ahead and create a new rule within here.
Let's give a rule number of 99 and the source, let's say the IP address of my current ISP.
And within that I just see all traffic and within the allowed the name.
I'll set the night and I'll click on saving this.
Great.
And so if we're looking to the inbound rules over here, you have a new rule over here, which is the
highlighted one, which is the denial rule.
And the source IP address is my current AP.
So now what will happen is anytime this specific IP address makes a request to any resources that are
part of the PCB it one EC2 instance, be it 2000, easy to instance, the traffic will be blocked.
So let's quickly verify.
So if I train bing again, you see, we're not able to establish the connectivity order.
I look and see and as soon as we remove the rule, let's try it out.
So this rule number 99, let's remove it.
Will do as he changes.
And let's try to do up being again.
You see it is working perfectly great.
So I hope at a high level overview you understood the basic functionality of network design and in fact
this specific use case that we were discussing, this is one of the common use cases that you will see
in organization where there is a IP address that is continuously brute forcing multiple easy to instances
and you want to block that IP address from your entire VPC so that it does not really reach any of the
easy to instances.
So in order to quickly do that, network design is a great way to achieve that.
So before we conclude, let's look into some of the important pointers for.
One is that each subnet in your VPC must be associated with the network.
See?
Now, if you do not explicitly associate the subnet with the network, you see the subnet is automatically
associated with the default network.
You see it.
So generally there is a default network easy and that gets created automatically.
So this default network ACL will be associated with all of the subnets by default.
All right.
So this is the default network ACL that allows all inbound and outbound IPV four traffic and if applicable,
IPV six traffic as well.
And the last important point is you can associate a network ACL with multiple subnets.
However, a subnet can be associated with only one network ACL at a time.
Now, one thing I wanted to make it clear is that this network ACL that you see, in fact this called
region, this is the region that I'm using for the first time for this specific account.
So this is basically a default VPC that was already created within the region.
So this default to be busy also comes up with the default network ACL.
So this is the default negotiation that we were discussing about.
And this is what it basically means that if you do not explicitly associate a subnet with a network,
is the subnets automatically associated with a default network is I'll have you add in this if you want
to create a custom network ACA, this is also something that you can easily do.
So from here you can create the Custom Network ACL and you can associate that custom negotiation with
a specific subnet within the VPC.
So this is the high level overview about the network.
You see it and with this will conclude today's video.