AWS VPC NACL Lab - Case study

​

Overview

​

Lab Details

1. This Lab walks you through the steps to create a custom NACL and associate the NACL to subnets.
2. Duration: 1 hour
3. AWS Region: US East (N. Virginia) us-east-1

​

Introduction

1. Overview of AWS VPC: Provide a brief explanation of what Amazon Virtual Private Cloud (VPC) is and its significance in the AWS ecosystem. Emphasize the concept of virtual networks, subnets, and their role in achieving network isolation and security in the cloud.
2. Introduction to Network Access Control Lists (NACLs): Explain the purpose and functionality of NACLs within an AWS VPC. Highlight that NACLs act as a firewall for controlling traffic at the subnet level, allowing or denying inbound and outbound traffic based on user-defined rules.
3. Importance of NACLs: Discuss the significance of NACLs in enhancing the security posture of an AWS VPC. Explain that NACLs complement security groups by providing an additional layer of defense, enabling more granular control over traffic flows.
4. Lab Objective: Describe the main objective of the AWS VPC NACL Lab. Emphasize that the lab aims to provide participants with practical experience in configuring NACL rules and understanding their impact on network traffic.
5. Lab Environment: Provide an overview of the lab environment, detailing the pre-configured AWS resources such as VPCs, subnets, and instances that participants will use during the lab. Mention any additional tools or services utilized to facilitate the lab exercise.
6. Lab Tasks: Outline the specific tasks participants will perform in the lab, such as creating NACLs, defining inbound and outbound rules, associating NACLs with subnets, and observing the effects of these rules on network traffic.
7. Learning Outcomes: Highlight the key learning outcomes participants can expect from the AWS VPC NACL Lab. These may include a better understanding of NACL functionality, improved ability to configure secure networking within an AWS VPC, and familiarity with troubleshooting common NACL-related issues.
8. Conclusion: Summarize the importance of NACLs in securing AWS VPCs and how the AWS VPC NACL Lab provides a hands-on learning experience to reinforce this knowledge. Encourage participants to actively engage with the lab and explore different scenarios to enhance their understanding of NACLs.

​

Architecture Diagram

​

Task Details

1. Sign into the AWS Management Console
2. Creating a New VPC
3. Create Subnets
4. Create and attach an Internet Gateway
5. Create Route Tables and Associate them it with Subnets
6. Update Route Table and Configure the Internet Gateway
7. Enabling Auto-Assign Public IP for Public Subnets
8. Launching an EC2 Instance in the Public Subnet
9. Launching an EC2 Instance in the Private Subnet
10. Testing Both EC2 instances.
11. Creating Custom NACL and Associate it to the Subnet
12. Testing the Public and Private Server
13. Adding Rules to Custom NACL (MyPublicNACL)
14. Testing Both EC2 instances

​

Launching Lab Environment

1. To launch the lab environment, Click on the Start Lab button.
2. Please wait until the cloud environment is provisioned. It will take less than a minute to provision.
3. Once the Lab is started, you will be provided with IAM user name, Password, Access Key, and Secret Access Key.

Note : You can only start one lab at any given time

​

Lab guide

​

Lab Steps

​

Task 1: Sign in to AWS Management Console

1. Click on the Open Console button, and you will get redirected to AWS Console in a new browser tab.
2. On the AWS sign-in page,
   • Leave the Account ID as default. Never edit/remove the 12 digit Account ID present in the AWS Console. otherwise, you cannot proceed with the lab.
   • Now copy your User Name and Password in the Lab Console to the IAM Username and Password in AWS Console and click on the Sign in button.
3. Once Signed In to the AWS Management Console, Make the default AWS Region as US East (N. Virginia) us-east-1.

​

Task 2: Creating a New VPC

1. Navigate to VPC by clicking on the Services  button on the top of the AWS Console.
2. Click on VPC (under Networking & Content Delivery section) or you can also search for VPC.
3. Click on Your VPCs from the left menu.
4. Here you can see the list of all VPC. No need to do anything yet. We will create a new VPC for this lab.
5. Click on Create VPC.
   • Name tag: Enter MyVPC
   • IPv4 CIDR block: Enter 10.0.0.0/16
   • IPv6 CIDR block: No need to change this, make sure No IPv6 CIDR Block is checked.
   • Tenancy: No need to change this, just be sure Default is selected.
   • Click on Create VPC.
6. Once the VPC is created, it will look like the example below:

​

Task 3: Creating Subnets

1. For the Public Subnet**,** click on Subnets from the left menu and click on Create subnet.
   • VPC ID           : Select MyVPC from the list.
   • Subnet Name      : Enter MyPublicSubnet
   • Availability Zone    : Select us-east-1a
   • IPv4 CIDR block    : Enter the range 10.0.1.0/24
   • Click on Create Subnet
2. For Private Subnet**,** click on Create Subnet again.
   • VPC ID            : Select MyVPC from the list.
   • Subnet Name        : Enter MyPrivateSubnet
   • Availability Zone    : Select us-east-1b
   • IPv4 CIDR block    : Enter the range 10.0.2.0/24
   • Click on Create subnet.

​

Task 4: Create and attach an Internet Gateway

1. Click on Internet Gateways from the left menu and click Create Internet Gateway.
   • Name Tag : Enter MyInternetGateway
   • Click on Create Internet Gateway.
2. Select the Internet gateway you created from the list.
   • Click on Actions.
   • Click on Attach to VPC.
   • Select MyVPC and click on Attach to VPC.

​

Task 5: Create Route Tables and Associate them it with Subnets

1. Go to Route Tables from the left menu and click on Create route table.
   • Name Tag: Enter PublicRouteTable.
   • VPC: Select MyVPC from the list.
   • Click on Create route table.
2. We will be using the default (main) Route Table created by VPC for the RDS database tier.

• You will be able to see the Route table with VPC ID MyVPC and Main as Yes
• Select the Route Table and rename it.
• Name Tag: Enter PrivateRouteTable and [Enter]

3. Now associate the subnets to the route tables.
4. Click on PublicRouteTable and go to the Action and in that go to Edit Subnet Associations tab.
   • Click on  Edit Subnet Associations.
   • Select MyPublicSubnet from the list.
   • Click on Save Associations
5. Click on PrivateRouteTable and go to the Action and in that go to Edit Subnet Associations tab.
   • Click on  Edit Subnet Associations.
   • Select MyPrivateSubnet from the list.
   • Click on Save Associations

​

Task 6: Update Route Table and Configure the Internet Gateway

1. PublicRouteTable : Add a route to allow Internet traffic to the VPC.

• Select PublicRouteTable.
• Go to the Routes tab click on Edit routes. On the next page, click on Add route.
• Specify the following values:
  • Destination: Enter 0.0.0.0/0
  • Target: Select Internet Gateway from the dropdown menu to select MyInternetGateway.
  • Click on Save changes.

​

Task 7: Enabling Auto-Assign Public IP for Public Subnets

• Select  MyPublicSubnet from the Subnet list
• Click on Actions and then select Edit subnet settings
• Check the Enable Auto-assign IPv4 address check box
• Check the Enable resource name DNS A record on launch check box
• Now click on Save

​

Task 8: Launching an EC2 Instance in the Public Subnet

1. Navigate to EC2 by clicking on the Services menu in the top, then click on EC2 in the Compute section.
2. Navigate to Instances from the left side menu and click on Launch Instance.
3. Enter name as MyPublicEC2Server
4. Choose an Amazon Machine Image (AMI): Select Amazon Linux 2023 AMI.

• Choose architecture as 64-bit(x86)

• Key pair name: WhizKey
• Key pair type: RSA
• Private key file format: .pem

7. Select Create key pair Button.

8. In Network Settings Click on Edit Button:

• VPC : MyVPC
• Subnet : Choose MyPublicSubnet
• Auto-assign public IP: Enable
• Select Create new Security group
• Security group name : Enter MyWebserverSG
• Description : Enter My EC2 Security Group
• Check Allow SSH from and Select Anywhere from dropdown
  • Choose Type: SSH
  • Source: Anywhere
• For HTTP, Select Add Security rule Button
  • Choose Type: HTTP
  • Source:  Select Anywhere

11. Select View all Instances to View Instance you Created
12. Launch Status: Your instance is now launching, Click on the instance ID and wait for complete initialization of the instance till status changes to Running.

​

Task 9: Launching an EC2 Instance in the Private Subnet

1. Click on Launch Instances again at the top right of the EC2 dashboard.
2. Enter name as MyPrivateEC2Server
3. Choose an Amazon Machine Image (AMI): Select Amazon Linux 2023 AMI.

• Choose architecture as 64-bit(x86)

7. In Network Settings Click on Edit Button:

• VPC : MyVPC
• Subnet : Choose MyPrivateSubnet
• Auto-assign public IP: Disable
• Select Create new Security group
• Security group name : Enter MyServerSG
• Description : Enter My EC2 Security Group
• Check Allow SSH from and Select Anywhere from dropdown
  • Choose Type: SSH
  • Source: Select Anywhere
• For ALL ICMP IPv4 , Select Add Security rule Button
  • Choose Type: All ICMP IPv4.
  • Source:  Select Anywhere

11. Two servers are launched and ready.

​

Task 10: Testing Both EC2 instances

1. Public EC2 instances: We have installed a web application on this server.
   • Select the MyPublicEC2Server EC2 instance from the instance list.
   • From the Description tab, copy the IPv4 Public IP.
   • Now paste this IP in you Web Browser and click [Enter]
   • You will be able to see the following page:
2. Next, we will try to ping the Private EC2 from the Public EC2 instance.
   • SSH into EC2 Instance
     • Please follow the steps in SSH into EC2 Instance.
   • Once connected to the server:
     • Change to root user:

sudo su

• Copy the Private IP of MyPrivateEC2Server from the Description tab.
• Ping the Private Instance using the Private IPv4. ping <Private IP address>
• Example: ping 10.0.2.161

• Press [Ctrl] + C to stop instead of pause.
• Note: You were able to do these tasks because the Default NACL that was created during VPC creation allows both INBOUND and OUTBOUND by Default.

​

Task 11: Creating Custom NACL and Associate it to the Subnet

1. Navigate to VPC under the Services menu. Click on Network ACLs under Security
2. Click on Create Network ACL
3. Create Network ACL:
   • Name tag: Enter MyPublicNACL
   • VPC: Select MyVPC from the dropdown list.
   • Click on Create.
4. Associating MyPublicNACL to the Public Subnet
   • Select the Action tab and click on Edit subnet associations
   • Select both the Public and Private subnets from the table.
   • Click on Save changes
5. Renaming the Main NACL
   • Select the Default NACL of the VPC MyVPC
   • Enter the name MyPrivateNACL and click on Save

​

Task 12: Testing the Public and Private Server

1. Public EC2 Instance:
   • Navigate to the EC2 Instance Dashboard. Click on Instances from the left side menu.
   • Select the MyPublicEC2Server EC2 instance from the instance list.

• From the Description tab, copy the IPv4 Public IP.
• Now paste this IP into your web browser and click [Enter]
• You will see the following page:

2. Private EC2 Instance:
   • Since the Public NACL restricts all traffic, you won’t be able to SSH into the public EC2 Instance to ping the Private Instance.
   • Next, we are going to solve this.

​

Task 13: Adding Rules to Custom NACL (MyPublicNACL)

1. Navigate to VPC under the Services menu. Click on Network ACLs under Security.
2. Select MyPublicNACL from the list.
3. In the Inbound rules, click Edit inbound rules
4. Add the following rules:
   • HTTP click on Add rules,
     • Rule# : Enter 100
     • Type: Choose HTTP (80)
     • Source: Enter 0.0.0.0/0
     • Allow / Deny: Select Allow
   • For ALL ICMP- IPv4, click on Add rules,
     • Rule# : Enter 150
     • Type: Choose ALL ICMP - IPv4
     • Source: Enter 0.0.0.0/0
     • Allow / Deny: Select Allow
   • For SSH, click on Add rules,
     • Rule# : Enter 200
     • Type: Choose SSH (22)
     • Source: Enter 0.0.0.0/0
     • Allow / Deny: Select Allow
     • Click on Save changes
5. In the Outbound rules Tab, Click Edit outbound rules
6. Add the following rules:
   • Custom Port is already available,
     • Rule# : Enter 100
     • Type: Choose Custom TCP Rule
     • Port Range: Enter 1024 - 65535
     • Source: Enter 0.0.0.0/0
     • Allow / Deny: Select Allow
   • For ALL ICMP- IPv4, click on Add rules,
     • Rule# : Enter 150
     • Type: Choose ALL ICMP - IPv4
     • Source: Enter 0.0.0.0/0
     • Allow / Deny: Select Allow
   • For SSH, click on Add rules ,
     • Rule# : Enter 200
     • Type: Choose SSH (22)
     • Source: Enter 0.0.0.0/0
     • Allow / Deny: Select Allow
   • Click on Save

​

Task 14: Testing Both EC2 instances

1. We will try to ping the Private EC2 from the Public EC2 instance.
   • SSH into EC2 Instance
     • Please follow the steps in SSH into EC2 Instance.
   • Once connected to the server:
     • Change to root user:
       sudo su
       
   • Copy the Private IP of MyPrivateEC2Server from the Description tab.
   • Ping to the Private Instance using the Private IPv4. ping <Private IP address>
     • Example:

• Press [Ctrl] + C again to cancel the process instead of pausing it.
• Note: You were able to do these tasks because we added NACL Rules.

Do you know?

By participating in the AWS VPC NACL Lab, users acquire a range of practical skills and knowledge, including the ability to create NACLs, define rule sets for specific subnets, evaluate traffic patterns, implement allow and deny rules, and analyze the impact of NACL configurations on network communication. Additionally, participants gain insight into optimizing NACL configurations for different use cases, securing sensitive workloads, and mitigating potential security risks within their AWS VPCs.

​

Completion and Conclusion

• You have created a VPC using the VPC Wizard.
• You have created an Internet Gateway.
• You have created a private and public subnet for the VPC.
• You have created and associated Route tables.
• You have added routes to the Route table
• You have launched some EC2 instances into the Public and Private subnets.
• You have created a Custom NACL.
• You have associated the NACL with the subnets.
• You added inbound and outbound rules to the custom NACL.
• You have tested our VPC.

​

End Lab

1. Sign out of AWS Account.
2. You have successfully completed the lab.
3. Once you have completed the steps, click on End Lab from the IP Lab Portal dashboard.

​

What gets checked

• Create Amazon Custom VPC — Check whether a Custom VPC is created or not.
• Create Amazon Custom VPC Subnet — Check whether a Subnet is created for the Custom VPC or not.
• Create Internet Gateway — Check whether an Internet Gateway is created and attached to the Custom VPC or not.
• Create Amazon Custom VPC Public Route Table — Check whether a Custom VPC Public Route Table is created and an Internet Gateway route is added or not.
• Create Amazon Custom VPC Private Route Table — Check whether a Custom VPC Private Route Table is created or not.
• Launch an EC2 Instance — Check whether an EC2 Instance is launched or not.
• Create Custom VPC Network ACL — Check whether a Network ACL is created for the Custom VPC or not.

​

Related help

• FAQs and Troubleshooting