Hi, everyone, and welcome back.
Now, in today's video, we will be discussing about the rule ordering in education.
Now, do note that whenever you are working with an education, it is very important to be careful because
one wrong rule and the entire traffic to your VPC order and traffic to a product in an environment will
be blocked.
So it is important to understand in detail specifically related to the area of rule ordering.
Now as we know that in a network ECL, we can go ahead and add or remove rules.
So basically whenever you add or remove rules from a network, ECL attendees are automatically applied
to the subnet that the specific network is associated with.
Now if we look into the default network, ECL rules.
So these are the two rules that you will see.
One has a rule number of hundred and second one has a rule number of sort, and first one is allowing
all the traffic and the second one is denying all the traffic.
So the first name, when you see this, it creates a little amount of confusion.
So let's go ahead and understand more about this.
Now, in network, you see the rules are evaluated with the lowest number rule.
So, for example, if will see, you have to do numbers.
What you want is 99 and take in 100.
So the rules are evaluated with the lowest number rule.
So among this, the rule number 99 will be evaluated first.
Now, there is a very important second point earlier, which states that as soon as a rule matches the
traffic it is applied regardless of higher number.
Weird, dynamic, contradicted.
For example, let's say a traffic is coming from us IP of 1077 0.5.
And since this traffic is coming from this IP and it is mounting the rule number 99, so the traffic
will be allowed irrespective of what is mentioned in the other rule numbers over here.
So in the rule number hundred, it is specified denied from on.
However, since the traffic is matching the rule number 99, it is applied, it does not really go towards
the rule number 100.
Now, let's say a traffic is coming from 1077 0.10.
Now, that is not really matching rule number 99.
So then it goes ahead and looks in to the rule number 100, which is denied from what and the traffic
gets denied.
So this is the basic understanding about the rule ordering.
So let's go ahead and try it up.
So currently in the network ACL, if we look into the inbound rules, you have to rule toward your Venezuela.
Number 102nd is rule number star.
So let's go ahead and edit this in.
Now in the rule number hundred, we are basically specifying allow from all the IP address over here.
So let's go ahead and also create a new rule.
This thing will be specifying a rule number 301.
All right.
And within will also allow all the traffic.
And what will be doing?
I'll copy my current IP address.
I'll specify toward it.
And in the allowed me now I will say deny I and I likely conceived in this.
So if you look into the in most rules already you have one rule with the rule number of hundred which
is allowing all the traffic.
Then you have one more rule with the rule number of 101, which is basically denying the traffic from
a specific IP, which is my current IP address.
And you have a rule number stuck, which is denying traffic from all the IP address.
So what do you think?
Will I be able to connect to the easy to instance that is associated in a subnet where this network
is attached?
Let's find it out.
So I'll copy the IP address of the Easy to you.
And let's quickly do a thing if I present to you see we are getting up but fake reply from the easy
to instance.
No way exactly are we able to connect because whenever we send up bing related packet to the easy to
instance, it matches against that rule number 100 order.
Now since it matches against the rule number 800, the other rules which are 101 and about that these
rules will not be evaluated at all.
Now, let's go ahead and change again.
This time instead of hundred and one, let's say 99, I usually conceive changes.
Alright, so if we look here 99, it basically specifies my current baby and it is benign.
So let's go ahead and run the ping again.
And you see, this time it is not really working.
I don't.
Great.
So I hope with this you understood the basics of the rule ordering and importance of rule ordering in
the overall network is here.
Again, one important part to note is that network SCA looks at both the inbound as well as outbound
rules of idea.
So within the outbound you basically have all the traffic which is a load and hence the easy to sense
will be able to connect to the Internet as well.
Great.
Now a few important point does that you need to note.
So this is more of a networking point of view, but it is important for networks is first is that the
client that initiates the request chooses the ephemeral port range or area.
So let us quickly understand this with their diagonal.
So let's say that you have a server on the left and you have a client on the right.
Now the client wants to connect to the server on the S is export.
So if you'll see that a triple header and Englander server is is it ends in X in my sequel associated
with port 22 Port It and boat 3306.
So a client wants to connect to the side, do it on port 22 so he will initiate a connection on board.
22 of the server, however, does so.
Two has to respond back to the client.
So there will be a specific port in which the server also sends that a reply back to that line.
So this is basically ephemeral, boring.
So currently you'll see it is 5607.
So this is what the first pointer really referred to, which states that that line that initiates a
request chooses a ephemeral portrait in which the A would come.
So for example, let's take a look into a BCP dump based connection.
So if you'll you audio there is a specific IP address 172 21.55 So this IP address is basically of that
of the client.
So this IP address is connecting to a server with the IP of 128 190 9106.4 on the port of 80.
So SDP base request is something which is expected on this board.
Now, if will see what you had, the client has also a specific port which is five five, 427.
So what it basically means that once the server receives the request from the client, server also needs
to respond back to the client.
Now how will server respond back to the client?
So it will respond back with declined IP address followed by the port number.
So here we have seen that the client IP has port of 58427.
So in this reply packet audio you see the reply is made from the server which is 122 and 90 9106.4.
And this reply is going to the IP address of the client followed by the port, which is five, five,
four, two seven.
All right.
So just to revise, whenever a communication is taking place between a blind and a server, a client
opens and port, let's say 55607 from which it would send the data to the server on Port 22.
Now, when a server wants to respond back to the client, the response would be based on the IP address
of the client, followed by the port number that client had open.
So that is what the fourth point really means.
Now basically, why is this important for negotiation letters and as then so they know, will you go
ahead and edit the inbound rules?
Let's take an example.
Whenever you add a new rule over to you, you also specify a port range of here.
So it is important to note that a right set of port range be allowed in here.
Now, if you look into the second point out of the PPD, it clearly states that border 021023 additionally
that is of port and only after this 1023 are the ports which Golang uses to initiate the connection.
For example, again dependent upon the operating system, so many canal uses the port range of 3 to
762 61,000 requests originating from EAB uses from 102426583 play and so on over here.
Now let me also quickly give you an example of this.
So let's see, within this specific network easier, let's create a new rule.
First, let's go ahead and remove the previous rule.
Let's create a new rule with the rule number of 99.
Now, at this stage, whenever you specify the port range, this fortress would be that of the incoming
port.
For example, if you look into this diagram, whenever a client makes a request, so this is an inbound
request.
So whatever port that you specify, this would be the inbound port.
So if I do something like this, that means what it will be allowed at the network is sea level.
However, generally venue create the outbound rule.
This is where a lot of mistake generally happens.
Let me quickly show you.
So in the outbound rule audit let's.
A new rule LCA rule number of 99 and within yet you have a custom DCP and within the port range a let's
see, I allow a broad range of 0 to 1 023.
All right.
And the destination is 0000 and I'll specify a denial rule or I'll click on saving this.
All right.
So what this basically means that any traffic that is going from the resources that are part of the
VPC to this specific port range of any IP addresses, this traffic will be denied.
So at this stage, when I tried to connect to the easy two instance on the SSA sport, so let me just
do a quick SSA to it here.
Alright, so we're basically getting a connection timed out.
So for this, let's quickly verify the inbound rules, order it.
And yes, we have one in Montreal because of is that traffic was getting denied.
Let me quickly remove this rule.
Well, I'll quickly do a sea of changes here.
Let's try to do it as this is once more.
It is trying to connect to the easy to instance and we are getting up by meeting dinner.
This is completely fine, but mission denial is fine.
But at this stage we can clearly identify that the communication between my current Windows laptop and
easy to instance is happening.
But if I even know in the outbound rules audio it.
Let's edit this.
So from here we can identify that the Windows laptop that was connecting to the server on board 22 was
not really using one of these port images.
021023.
So now let's go ahead and changes.
Let's take a custom DCP and this thing.
Let's say 102426553 fake and you will see the name.
Let's do a sea change.
All right.
So now when you go ahead and connect to the instance once more, the connection you will see we are
not really getting any response back, primarily because our server is not able to respond back to the
client, because the ephemeral portrait that the client had used this ephemeral poor print is basically
not allowed in the outgoing connection of network.
You see it.
So if you can see it, you're basically getting the connection time.
So although this pointer that we were discussing, it is more to do with the networking concept.
But since we are working with Network here, I thought to include this specific slate so that there
is no confusion specifically when you implement the network ACL in production environments.
Always remember that specifically.
If you're working with outbound rules in network ACL, you need to know that you have to allow ephemeral
port print if you want things to work, if you will say allow 0 to 1 0 to 3 in the outbound, it will
not really work.
That land will not get the response back.
So you need to allow from 10242658 DFA, at least for the communication between a client and Nasarawa
to take this perfect limit.
So that's the high level overview about the network ACL and it's rule ordering.