Question

A company runs a web application on EC2 instances in a private subnet behind an internet-facing Application Load Balancer. A security engineer adds an inbound rule to the subnet's network ACL allowing TCP port 443 from 0.0.0.0/0 so users can reach the application. Users report that connections still time out. The instances' security group already allows inbound 443 from the ALB security group and all outbound traffic. What is the MOST likely cause and correct fix?

Accepted Answer

Network ACLs are stateless, so the subnet's outbound (egress) NACL rules must explicitly allow the ephemeral return port range (e.g., TCP 1024-65535) to the client; add that egress rule.

Answer

Security groups are stateless, so an explicit outbound rule allowing the client ephemeral port range must be added to the instance security group.

Answer

The inbound NACL rule must reference the ALB security group ID instead of a CIDR block; change the source to the ALB security group.

Answer

NACL rules are evaluated by lowest rule number first, so the port 443 rule is being overridden by a lower-numbered deny; renumber the 443 rule to 1.