Question

A network engineer configures a web server in a public subnet. The security group allows inbound TCP 443 from 0.0.0.0/0, and all outbound traffic is allowed. However, the subnet's network ACL was hardened with only these rules: inbound rule 100 ALLOW TCP 443 from 0.0.0.0/0, and outbound rule 100 ALLOW TCP 443 to 0.0.0.0/0. All other NACL traffic is denied. Clients report that TLS handshakes to the web server time out. What is the MOST likely cause and correct fix?

Accepted Answer

The NACL is stateless and does not allow the ephemeral port return traffic; add an outbound NACL rule allowing TCP ports 1024-65535 to 0.0.0.0/0.

Answer

The security group is blocking the return traffic; add an inbound security group rule for ephemeral ports 1024-65535.

Answer

The NACL inbound rule must also allow ICMP; add an inbound NACL rule permitting ICMP echo requests.

Answer

The security group outbound rule is too permissive; restrict it to TCP 443 to fix the handshake timeout.