Question

A security engineer configured a custom network ACL on a public subnet hosting a web server. Inbound rules allow TCP 443 from 0.0.0.0/0, and outbound rules allow only TCP 443 to 0.0.0.0/0. Users report that HTTPS requests to the web server time out, even though the security group correctly allows inbound 443. What is the most likely cause?

Accepted Answer

The NACL outbound rules do not allow the ephemeral port range required to return response traffic to clients.

Answer

Network ACLs are stateful, so the inbound 443 rule already covers return traffic; the security group must be the problem.

Answer

The NACL is missing an inbound rule allowing ICMP, which is required to complete the TCP handshake.

Answer

Outbound TCP 443 rules must specify the client IP addresses explicitly rather than 0.0.0.0/0.