In this tutorial, you'll learn how to configure security groups and network ACLs in AWS VPC.
—
Facebook: [ Ссылка ]
—
Video Transcript:
_
Hi guys, this is Abhi from Gokcedb. In this video, you're going to learn how to configure security groups in network ACL in your AWS VPC. Let's start by navigating to the vpc service then click on create vpc.
Give your vpc a name and select a sider block. I'm going to leave the tenancy to default and select 1 for availability zones. Select one for a public subset, one for the private subnet, and one for a nat gateway.
I don't need a vpc endpoint so I'm going to select none and then hit create vpc. Give it a few minutes for the vpc workflow to complete then click on view vpc. As you can see, we have two subnets.
One public, one private, two route table, one public, one private, one internet gateway, and one nat gateway. Next, click on security groups and hit the create button. I'm going to call it my web access public because a public ec2 instance will be associated with it.
Select your project vpc then click on add rule in the inbound rules section. Here, I'm going to enable HTTP ICMP and ssh protocol access from anywhere. Hit create then go back to the security group screen.
Let's create one more security group for our private ec2 instance. For inbound rules, I'm going to only enable HTTP and ICMP traffic coming from my public security group. Hit create then navigate to the ec2 dashboard.
Here, we're going to launch two instances. One in the public subnet and the other one in the private subnet. Click on instances then hit the launch instance button.
Give your instance a name, select an AMI keypair then click on edit in the network settings. Select your project PPC as a public subnet. Enable auto-assign public IP then select the public security group.
Scroll down to the user data section. Here, I'm going to copy-paste this startup script. In this script, I'm bringing up the httpd web server then grabbing the availability zone and subnet id metadata and pasting it into the index.html file.
Click on the launch instance then hit the refresh button. You should see your instance in a pending state. Next, let's create one more instance in your private subnet in the network settings.
Select your vpc and a private subnet. Disable auto-assign public IP and select the private security group. In the user data section, I'm going to copy-paste the same startup script and then hit the launch instance button.
Let's look at the architecture diagram. At this point, we have to ec2 instances. One in public and the other in the private subnet.
Ec2 instance in the private subnet can go out to the internet via the nat gateway and the ec2 instance in the public subnet can go out to the internet using the internet gateway. Let's copy the public IP address of the public ec2 instance and paste it into a browser. As expected, we can see the availability zone and the subnet id information.
Now, let's try to connect to the public ec2 instance using instance connect. If I grab the private IP address of the private ec2 instance and use the curl hyphen s command to access it you can see that we can get the availability zone and subnet id information for the private instance as well. Since we enabled the ICMP access, we can also ping the private IP of the private ec2 instance.
Watch what happens if I go back to the security groups and delete the ICMP rule from my private security group. Now, if I try to ping the IP of my private ec2 instance you'll see that I'm experiencing 100 packet loss. Let's re-add the ICMP rule before moving forward.
Next, go back to the vpc dashboard and click on network acls. Here you can find a default network ACL already attached to our project vpc. If you go back to the diagram, you can see that the network acls are associated at the subnet level but you can have one network ACL attached to multiple subnets.
Go inside your default network ACL then click on edit inbound rules. Here, I'm going to add a deny ICMP rule above the allow all traffic rule. Since the network ACL's rules get processed in the order the 99 rule will get processed before the 100 allow everything rule.
Hit save then go back to the instance connect window. Now if I try to ping the IP of the private ec2 instance, I should experience 100 packet loss because of this rule. On the flip side, if I change the rule to allow.
I should be able to ping the private ec2 instance. This time I'm experiencing 100 packet loss. There you have it.
Make sure you like, subscribe, and turn on the notification bell. Until next time.
