网络课程笔记

00:00 Hello, and welcome to this lecture, Firewalls inside VPC.

00:03 So far, what we have seen is, all about the networking.

00:06 We saw VPC, subnets, route table,

00:09 and essentially all these component sets up the network

00:12 between the EC2 instances and other components.

00:15 So, what we talked about is, if there are multiple,

00:17 say, EC2 instances, and they want to talk to each other,

00:21 what kind of networking things we will set up.

00:24 So there will be a VPC and route table and everything.

00:26 And this ensures that traffic can flow from

00:29 one machine to another machine, right?

00:31 Now, you consider this network as a say,

00:34 highway between two cities and we are just making sure

00:38 there is a road to go from one city to another city.

00:41 That's all about the networking.

00:43 Now, in this lecture, we want to talk about firewalls,

00:46 which are like, you know,

00:47 toll booths outside of your city.

00:50 So, if you want to enter the city,

00:52 you need to take permission from the person.

00:55 So these are called the firewalls, right?

00:57 And in VPC, there are two kinds of firewalls,

01:00 security groups and network ACL,

01:03 or network access control list.

01:05 So from this diagram, you can see that,

01:07 security groups are closely associated

01:09 with the EC2 instance,

01:11 however, the network ACL sits at the subnet level.

01:14 That means when the traffic comes in,

01:16 first, it hits the network ACL,

01:18 if it allows that traffic,

01:20 it will go to the security group,

01:22 if it allows the traffic,

01:23 it will reach to your EC2 instances.

01:25 And the same way, the other way around.

01:27 If the traffic has to go from your EC2 instances

01:30 to outside, outside of VPC or to the internet,

01:34 again, it has to pass both these firewalls,

01:38 security groups and network ACL.

01:40 And that's how the traffic can be controlled.

01:43 So, we are going to deep dive into

01:45 both these firewalls shortly.

01:48 Okay, let's look at the security group first.

01:50 So, these are the fundamental of networking security in AWS,

01:54 and you must understand security group well.

01:57 They control the traffic, how it is allowed into,

02:00 or out of your EC2 machine.

02:02 And given an example, suppose there is an internet

02:05 and someone is trying to reach, to say, your EC2 instance,

02:08 you've make sure you are allowing that traffic to come

02:12 into your EC2 instance via the security group.

02:15 So that's an inbound traffic for your instance.

02:17 And if your instance is going out to internet,

02:20 that is called the outbound traffic for your EC2 instance.

02:24 So, it is must that, you understand

02:27 how security group works,

02:29 what kind of traffic you can control,

02:31 and what is the difference between

02:33 security groups and network ACL.

02:35 And we'll see that shortly.

02:37 So, security group typically prevents

02:41 traffic to reach to certain port of your EC2 instances.

02:44 And we will see how that works.

02:47 So, given a security group,

02:50 which is attached to your EC2 instance,

02:52 there could be multiple EC2 instances as well.

02:55 But, here we are showing,

02:56 like, there is one security group

02:58 and are some inbound rules here,

03:00 and there are outbound rules into your security group.

03:03 So, in inbound rule, if you allow certain IP addresses

03:07 to connect to your EC2 instance on certain port,

03:11 then the traffic will be allowed.

03:12 For example, you want to allow a traffic on port 22,

03:16 it will be allowed.

03:17 However, if there is some other machine

03:19 which has some different IP address, of course,

03:22 and you do not authorize that rule as an inbound rule

03:25 into your security group,

03:27 the traffic will not be allowed,

03:28 It would be denied.

03:30 Similarly, from your EC2 instance,

03:32 if you want to go outside and reach to the internet,

03:35 and if that traffic is allowed in the outbound rule of the

03:37 security group, then only from your instance,

03:40 you would be able to reach to internet.

03:43 So, security group essentially regulate

03:46 the access to the ports.

03:48 Now, what do I mean by access to the port is like,

03:51 you have EC2 instance and you have some,

03:54 say, web application running inside this EC2 instance,

03:57 it must be listening on some port, right?

03:59 Typically 80 or 4, 4, 3.

04:01 So in the security group,

04:02 you will define rule,

04:04 which is bound to these ports there.

04:07 Now, as a source, who can connect to your EC2 instance?

04:11 They could be IPv4 addresses,

04:13 or they could be IPv6 addresses.

04:15 So in the source part of the rule,

04:17 you will define which IPC ideas can connect to my instance.

04:21 Now they control the traffic which flows

04:23 inside your EC2 instance,

04:24 as well as the traffic which goes out of your EC2 instance.

04:29 So all this is controlled using the security group.

04:32 Now, there is a very good thing to understand

04:35 about security group,

04:36 is that , security groups are stateful.

04:39 So, this is very important, with respect to exam as well.

04:42 And let's try to understand what does that mean.

04:45 Let's take an example.

04:47 You have an EC2 instance.

04:49 Pardon my diagram.

04:50 And, you are again, running a web server,

04:53 which is listening on port 80 onto your machine.

04:56 And you want to make sure everyone can access your website.

05:01 And this is, say, your machine

05:04 and it has some random IP address, 1,2,3,4,

05:07 just for an example.

05:08 So of course, you will attach one security group

05:11 to your instance here, right?

05:13 And you will write some inbound rules.

05:16 That is the first thing you need to do.

05:18 So there will be some inbound rule

05:19 and there will be some outbound rule.

05:22 So, what inbound rule do you need here?

05:25 Of course, you need a rule which says,

05:29 for STTP port 80, I want to allow

05:33 IP address 1 dot 2 dot 3 dot 4

05:35 to connect to my instance.

05:37 Now, as soon as this happens,

05:39 you can connect from here to here

05:41 over the internet.

05:42 Now this is, this is given because we have added this rule.

05:47 Now, what about the outbound, right?

05:49 If you see my EC2 will response,

05:52 respond with the web content,

05:53 that means it will also send the data

05:55 out to my this machine.

05:57 And if you look at, this looks to be an

05:59 outbound traffic for my EC2 instance.

06:01 So does that mean you have to also open, say, rule,

06:05 which says the return traffic has to go to this IP address,

06:08 like here,

06:10 that is not required in EC2 instance security groups.

06:14 So, that's where security groups are called stateful.

06:16 That means, you don't need to write an outbound,

06:20 sorry, return traffic into the outbound rules.

06:23 It is by default allowed.

06:25 So, if you are allowing the inbound traffic,

06:28 the written traffic will go automatically.

06:30 Even if you don't have any rule here,

06:32 the traffic will still go back.

06:33 So that's a statefulness of your EC2 instances.

06:37 And remember this, because it's very essential for some of

06:40 the scenarios given in the exam,

06:42 security groups are stateful vs the network ACL,

06:46 which we'll see shortly, right?

06:48 So that's the one thing.

06:49 But, considered another case, where now you don't have,

06:53 for example, this scenario,

06:55 but your EC2 instance is trying to reach to www, internet.

07:00 Now, in this case, in the outbound rule,

07:03 here, this is an outbound traffic,

07:04 which is originating on my EC2 instance, right?

07:08 In that means, also, I need to now open a port

07:14 80 of this server, which could be internet.

07:17 So I'll do that in my outbound rules,

07:19 because now traffic is originating from my EC2 instance

07:23 and going out to the internet.

07:25 And the similarly,

07:26 I don't need to have now inbound rule again,

07:28 for the return traffic from here.

07:30 So, even if my inbound rule does not have anything,

07:33 this traffic will come back to my EC2 instance.

07:36 So I know this could be a little confusing,

07:38 but this is what an EC2 instance

07:40 security group statefulness means.

07:42 So remember these things.

07:44 Okay, one more thing about the security group,

07:47 which you need to remember is that,

07:48 you can reference another security group into,

07:52 as a source into your inbound rule or an outbound rule.

07:56 Now, what does that mean?

07:58 So this is just an example of how inbound rules looks like,

08:01 and this is the referencing security groups

08:04 into the inbound rules of another security group.

08:08 So let's take an example,

08:09 You have an EC2 instance,

08:10 and there is one security group attached to this instance,

08:13 what you can do,

08:15 instead of adding this IP address as a source,

08:18 you can add a security group of this EC2 instance

08:22 as a source.

08:23 Now, this looks something weird.

08:27 That means, we are not really adding

08:28 an IP address or a CIDR,

08:30 we are directly adding the security group as a source.

08:33 Now, why someone would do that?

08:35 Let's take an example.

08:36 Suppose you have a fleet of say web servers, right?

08:41 And there are multiple EC2 instances

08:42 in this web server tier.

08:44 Now these are all EC2 instances,

08:46 and this is my web tier,

08:47 and this is my EC2 instances, right?

08:51 And now this, my web tier talks to app tier.

08:54 So similarly I have app tier, here.

08:57 App tire is like application servers.

08:59 Again, these are multiple EC2 instances.

09:05 Now, every web tier should be able to talk to

09:08 any of the app tier.

09:11 And in that case, it would make sense to create

09:13 one dedicated security group,

09:15 and which is attached to all my application servers.

09:19 And this security group says, connect to say, port 80, 80.

09:23 Right? 80, 80 of any of these apps servers,

09:26 and the source would be,

09:28 you'd have to add all the IP addresses

09:29 of all the web servers into this as a source,

09:32 as an inbound rule.

09:34 Because, you know, this machine should only accept traffic

09:36 from this web servers.

09:38 Now that's something extra work, right?

09:41 If tomorrow you add one more web server here,

09:43 you need to add this entry here again in the inbound rule.

09:46 And this concept of referencing security group

09:50 actually

09:51 help us here.

09:52 So for example,

09:53 now web tier also we have one security group, right?

09:56 Which allows again, traffic from the internet,

09:58 say, on port 80, I'm allowing the inbound rule from 0, 0, 0,

10:02 but we are not concerned about that right now.

10:05 What we say, in this security group,

10:08 if the security group ID say 1, 2, 3,

10:11 we will have an inbound rule here. We say, port 80, 80,

10:15 allow traffic as a source from this security group,

10:20 which is SG

10:22 1 2 3

10:24 Now, even if you add a new EC2 instance

10:27 in this web tier.

10:29 Of course, I'm assuming this EC2 instance

10:31 would be attached to the same security group.

10:34 You don't need to do anything.

10:35 As you have source as this security group,

10:38 that traffic will automatically be allowed.

10:41 So that's what this referencing the security group means.

10:45 Here, we are allowing this two security groups

10:49 to be as an inbound rule for my,

10:51 this instance, So traffic would be allowed.

10:54 But if there is a third instance,

10:56 which has a different security group,

10:58 the traffic won't be allowed.

11:00 So essentially, this is what the,

11:01 referencing the security group means,

11:03 and you can do that very well.

11:05 So, good to know about security group.

11:07 Now, a security group can be attached to multiple instances.

11:10 This is what we just saw in the web and app tier.

11:16 Security group can be logged on

11:17 at region and VPC combination,

11:20 which means they are at a VPC level.

11:23 The traffic leaves outside your EC2 instance.

11:28 That means, it hits the security group,

11:30 and if security group does not allow,

11:32 it never hits your EC2 instance.

11:35 If your application is not accessible,

11:38 you get a timeout error.

11:39 Typically, it's a security group problem.

11:41 If it is a connection refused error,

11:44 then it means, security group is allowing,

11:47 but your application is not allowing that traffic.

11:49 So, this could be helpful in troubleshooting certain

11:53 scenarios given in the exam.

11:55 Now, by default, if you create a new security group,

11:59 all the inbound traffic is blocked.

12:01 When I say blocked, that means there are no rules

12:03 in the security group.

12:04 So, your security group will look something like this,

12:06 there are no inbound rules.

12:08 And all the outbound traffic in default security group

12:12 would be all allowed.

12:13 So, you'll see all traffic allowed to reach to the internet.

12:17 So that's a default behavior of security group,

12:20 but of course you can anytime go and change that behavior,

12:23 you can add an inbound and outbound rules as you want.

12:26 So, that's about security group.

12:28 And we will shortly see now about the

12:30 network ACL in the next lecture.

12:32 Thank you.