configure network acl in aws

How to Configure Network ACL in AWS

In this blog, I will show you how to configure network ACL in AWS. We are going to create a custom VPC network ACL for our VPC and explicitly DENY all access to our public subnet. ACL (Network access control) list is an optional layer of security for the VPC that acts as a firewall for controlling traffic in & out of one or further subnets. You might setup network ACLs with rules comparable to your security groups in order to add an additional layer of security to your VPC.

How to Create VPC Tokyo

1- Login to the AWS account and select AWS Services tab and then select VPC under Networking & Content Delivery.

aws management console services

2- Under Virtual Private Cloud select Your VPCs
Click on Create VPC.

aws create vpc

3- Create VPC wizard,
Name tag – VPC1
IPv4 CIDR block –
Tenancy – default
Click Create

aws create vpc

4- Click close.

the following vpc was created

5- Now you can see VPC successfully created.

your vpcs

How to Create Subnet

1- Select Subnets.
Choose Create Subnet.

subnets aws

2- Name tag – PublicSubnet.
VPC – select the VPC1 that you created earlier.
Availability Zone
IPv4 CIDR block – enter a valid CIDR block. For example (
Click Create.

create subnet aws

3- Click close

following subnets successfully created

4- Subnets successfully created.

subnet amazon management console

How to Create Internet Gateway

1- Click on Internet Gateways new on your left side and then click Create Internet Gateway.

aws create internet gateway

2- Enter a name (IGW1) in the Name tag text box and then click create internet gateway.

aws create internet gateway name

3- The internet gateway has been created and is in a detached state. We need to attach it to your VPC. In the action, menu select Attach to VPC.

aws internet gateway detached

4- Choose your VPC1 from the drop-down menu and then click Attach internet gateway.

attach internet gateway

5- The internet gateway changes to attached state.

internet gateway status attached

How to Create Route Table

1- Select Route Tables.
Click on Create route table.

create route table

2- Name tag – enter a name for the route table (Public-Route).
VPC – Choose your VPC1, and then select Create.

create route table name

3- Click Close.

route table was created

Configure Network ACL in AWS

Routing of public subnets

Now we need to configure the routing for the subnets. Enable traffic from your subnets to Internet by using the internet gateway attached to the VPC.

4- Choose Ohio-Route, Choose Routes tab and then click Edit routes.

Click Add route

edit routes aws

The traffic from instances in the subnets predestined to the Internet will be redirected to the Internet Gateway.

Then we are redirected to the Route Table in the Virtual Private Cloud.
Add route for the Route Table – 1 for the traffic to the Internet to be routed using the Internet Gateway.

5- Select Add rules for destination type (all packets for the internet) and then for targets select the Internet Gateway.

edit routes target

6- Select (IGW1) have created as in the earliest and then select save routes

edit routes target

7- Click close.

routes successfully edited aws

8- Successfully route edited

Choose Subnet Associations tab and then choose Edit Subnet associations.

create route table aws-

9- Select your subnet (PublicSubnet) and then click Save.

edit subnet associations save

10- Successfully edit subnet associations.

create route table aws-

How to Create a Network ACL

Open the Amazon VPC console

1- Select Network ACLs under Security and then Create Network ACL.

create network acl aws

2- Create Network ACL wizard, type a name of your network ACL, and select the ID of your VPC (VPC1) from the list. Then select Yes, Create.

create network acl name aws

How to associate a subnet with a network ACL

3- Select subnet associations and then click edit subnet associations.

create network acl details aws

4- Select the subnet checkbox for the subnet to associate with the network ACL, and then choose Save.

edit subnet associations save

To add rules to a network ACL

5- Select Network ACLs, select Inbound Rules and then edit inbound rules.

network acl edit inbound rule

6- Click Add Rule.

network acl add rule

Enter a rule number (for example, 100). The rule number should not already be in use in the network ACL. We operation the rules in order, starting with the lowest number.
We recommend that we leave gaps between the rule numbers (example 100, 200, 300), rather than using sequential numbers (101, 102, 103). This take it easier adds a new rule without having to renumber the existing rules.

RuleTypeProtocolPort RangeDestination
100RDP (3389)TCP (6)33890.0.0.0/0
200Custom TCP RuleTCP (6)1024-655350.0.0.0/0

7- Select Save.

network acl edit inbound rule

8- Select Outbound Rules tab, and then choose Edit outbound rules.

network acl edit outbound rule

9- Click Add Rule.

network acl edit outbound rule

10- Edit Outbound Rule.

RuleTypeProtocolPort RangeDestination
100HTTP (80)TCP (6)800.0.0.0/0
200HTTPS (443)TCP (6)4430.0.0.0/0
250Custom TCP RuleTCP (6)1024-655350.0.0.0/0

11- Select Save.

network acl edit outbound rule save

Create Instance

1- Select service tab, click on EC2 under compute.

aws management console

2- Click on Launch Instance button.

aws launch instance

3- Select Microsoft Windows Server 2019.

aws instance choose ami

3- Choose t2 micro.
Click Next : Configure Instance details

aws choose instance type

5- Network – select VPC (VPC1).
Subnets – select PublicSubnet.
Auto Assign Public IP – select Enable.
Click on Next : Add Storage.

aws configure instance details

6- Click Next : Add Tags.

aws add storage

7- Click on Next : Configure Security Groups.

aws add tags

8- I keep it default Security
Select Protocols ALL traffic, Protocol all, Port Range (0-65535) Select Source Anywhere
Click on Review and Launch.

aws configure security group

9- Review the instance details, parameters and then click launch.

aws review instance launch

10- I am using existing key pair
Click launch instance.

aws key pair name

Related: How to create Instance in AWS

Testing Configure Network ACL in AWS

1- Select Instance and then click connect.

aws instance connect

1- Select Get Password
Select choose file, choose your key pair, and then click decrypt password
Copy password and then choose download remote desktop file.

get password aws

3- And login to Instance.

enter your credentials

4- Now you can see internet is working.

ec2 instance desktop

Written by Jamil Parvez

Jamil Pervez works as a Network Administrator, based in Kuwait with a Primary focus on Microsoft technologies. Microsoft Certified MCSE, MCTP, MCITP, CCNP, CCIP, CCVP with 20 years of experience in administering Windows Servers, Exchange, VMWare, Veeam B&R, Veritas BackupExec.

Leave a Reply

service apache can not start

Service Apache can not start. Reason: Fixed

uninstall or remove laragon

How to Uninstall or Remove Laragon in Windows 10