🖼️ See the drawing + lab 🏠 Course home 🌿 Branch on GitHub ✏️ View source

🖼️ आकृती आणि labThe drawing + lab पूर्ण पानावर उघडा ↗Open full page ↗

🧍 धडा 05 — Networking — security groups आणि NACLs: पाहुण्यांची यादी आणि विंगचे दार

📍 तुम्ही इथे आहात: 12 पैकी धडा 05 · मागे: lesson-04-storage · पुढे: lesson-06-connecting

📦 या ब्रँचमध्ये काय आहे

धडे 01–04, आणि प्रत्येक packet ला भेटणाऱ्या दोन firewalls: security group (डेस्कवरची पाहुण्यांची यादी — stateful) आणि network ACL (विंगच्या दारावरचे नियम — stateless), दोन्ही ec2/sg.py मध्ये code म्हणून, ज्यातून तुम्ही packets पाठवून पाहू शकता.

🧒 5 वर्षांच्या मुलाला समजावल्यासारखे

डेस्क इमारतीच्या एका विंग मध्ये बसलेले असतात (एक subnet), शाळेच्या स्वतःच्या आवारात (VPC).

विंगच्या दारावर 🚪 एक नियम-फलक असतो (network ACL). तो आत येणाऱ्या प्रत्येक व्यक्तीला आणि बाहेर जाणाऱ्या प्रत्येक व्यक्तीलाही तपासतो, वरून नियम वाचत — rule 90, rule 100, rule 110 — आणि जुळणारा पहिला नियम निर्णय घेतो. त्याची स्मरणशक्ती अगदी वाईट आहे: एखादा पाहुणा मिनिटापूर्वी आत आला आणि त्याचे उत्तर बाहेर जायला निघाले, तर फलक त्या उत्तराला अनोळखी म्हणून तपासतो. त्यासाठी नियम नाही? अडवले.

प्रत्येक डेस्कवर एक monitor पाहुण्यांची यादी 🧍 घेऊन उभी असते (security group). यादीत फक्त कोण आत येऊ शकते तेच लिहिलेले असते — "443 वरच्या web page साठी कोणीही", "22 साठी office चा laptop". तिची स्मरणशक्ती परिपूर्ण आहे: तिने पाहुण्याला आत येऊ दिले असेल, तर उत्तर कोणताही प्रश्न न विचारता बाहेर जाते. आणि ती कधीच "चालते व्हा" असे ओरडत नाही — अनोळखी व्यक्तीकडे सरळ दुर्लक्ष केले जाते, आणि ती कंटाळून निघून जाईपर्यंत थांबते (timeout).

🗺️ आकृती

flowchart LR
    visitor["🌍 198.51.100.9:51000"]
    nacl["🚪 NACL on the subnet — stateless<br/>100 ALLOW 443 · 200 DENY 22 · * DENY"]
    sg["🧍 security group on the desk — stateful<br/>443 from anywhere · 22 from 203.0.113.5/32"]
    desk["🖥️ web desk :443"]
    visitor -->|"1 in :443"| nacl -->|"2"| sg -->|"3"| desk
    desk -->|"4 reply to :51000"| sg
    sg -->|"5 remembered → allowed"| nacl
    back["NACL outbound needs 1024–65535<br/>without it → * DENY → the page hangs"]
    nacl -.->|"6"| back

🗺️ काढलेली आकृती + एक lab: https://school-edh.pages.dev/ec2/lesson-diagrams.html#l05

❓ काय

VPC आणि subnets — Region मधले तुमचे खासगी network; प्रत्येक subnet एकाच AZ मध्ये राहते. Public subnet ला Internet Gateway कडे route असतो; private subnet ला नसतो (तो बाहेर गेलाच तर NAT gateway मधून जातो).
Security group (SG) — instance च्या network interface ला जोडलेला. फक्त allow नियम (deny नाही), inbound आणि outbound साठी. Stateful: परवानगी दिलेल्या request चे reply आपोआप allowed असते. नवा SG आत काहीच नाही आणि बाहेर सगळे allow करतो. नियमाचा source एक CIDR (203.0.113.5/32) किंवा दुसरा security group असू शकतो ("load balancer चा SG घातलेले काहीही" — धडा 10).
Network ACL (NACL) — subnet ला जोडलेला. क्रमांक असलेले allow आणि deny नियम, सर्वात कमी क्रमांक आधी तपासला जातो; पहिला जुळणारा जिंकतो; शेवटचा * नियम बाकी सगळे deny करतो. Stateless: replies हे वेगळे packets असतात आणि त्यांना स्वतःचा नियम लागतो — सहसा outbound साठी ephemeral ports 1024–65535. Default NACL सगळे allow करतो; नवा custom NACL तुम्ही नियम जोडेपर्यंत सगळे deny करतो.
Dropped विरुद्ध refused — SG किंवा NACL ने drop केलेले timeout सारखे दिसते. "Connection refused" म्हणजे packet पोहोचला पण त्या port वर कोणीच ऐकत नव्हते — ही वेगळी समस्या आहे.

🤔 का

कारण network हे प्रत्येक डेस्कचे पुढचे दार आहे, आणि EC2 मधल्या बहुतेक घुसखोऱ्या "port 22 from 0.0.0.0/0" सारख्या नियमाने सुरू होतात. आणि कारण हे दोन स्तर उलट पद्धतीने अपयशी ठरतात: SGs बरोबर करायला सोपे आणि खूप उघडे ठेवायलाही सोपे; NACLs विसरायला सोपे, आणि reply चा नियम नसल्याने pages कुठेही error न दाखवता अडकतात.

🔧 कसे (या repo मध्ये)

ec2/sg.py मध्ये SecurityGroup (receive() सह, जे संभाषण लक्षात ठेवते, आणि reply()) आणि NetworkACL (क्रमांकानुसार लावलेले नियम, पहिला जुळणारा जिंकतो, मग शेवटचा deny) आहेत. ec2/demo.py मधले network() web डेस्कच्या SG कडे तीन पाहुणे पाठवते, एक reply बाहेर जाऊ देते, मग तीच request ephemeral-port नियमासह आणि त्याशिवाय NACL मधून चालवते. ec2/test_ec2.py मधले tests L05 हे तिन्ही वर्तन पक्के करतात. हे शिकवण्यासाठीचे model आहे: खरे SGs आणि NACLs ICMP सारखे protocols, IPv6 ranges आणि prefix lists सुद्धा जुळवतात.

🧪 करून पाहा

python3 ec2/demo.py network
python3 - <<'EOF'
import sys; sys.path.insert(0, "ec2")
from sg import SecurityGroup, NetworkACL
# the web desk only takes port 80, and only from inside the VPC (where the load balancer lives)
web = SecurityGroup("sg-web", [("tcp", (80, 80), "10.0.0.0/16", "80 from the VPC")])
for src in ("10.0.1.25", "198.51.100.9"):
    print(web.receive("tcp", src, 40000, 80))
# NACL rules are checked lowest number first — a DENY at 90 beats the ALLOW at 100
acl = NetworkACL("acl-public",
    [(90, "deny", "all", (0, 65535), "198.51.100.0/24"), (100, "allow", "tcp", (443, 443), "0.0.0.0/0")],
    [(100, "allow", "tcp", (1024, 65535), "0.0.0.0/0")])
for src in ("198.51.100.9", "192.0.2.44"):
    print(src, acl.inbound_ok("tcp", 443, src))
print("port 8080 from anyone:", acl.inbound_ok("tcp", 8080, "192.0.2.44"))
EOF

खऱ्या account वर (AWS credentials लागतात; तुमचे स्वतःचे VPC, SG आणि NACL IDs वापरा):

aws ec2 create-security-group --group-name school-web --description "web desks" --vpc-id vpc-0123456789abcdef0
aws ec2 authorize-security-group-ingress --group-id sg-0123456789abcdef0 --protocol tcp --port 443 --cidr 0.0.0.0/0
aws ec2 authorize-security-group-ingress --group-id sg-0123456789abcdef0 --protocol tcp --port 80 --source-group sg-0fedcba9876543210
aws ec2 create-network-acl-entry --network-acl-id acl-0123456789abcdef0 --egress --rule-number 110 \
    --protocol tcp --port-range From=1024,To=65535 --cidr-block 0.0.0.0/0 --rule-action allow

✅ तपासा — तुम्हाला काय दिसायला हवे

SG चा भाग छापतो ✅ 198.51.100.9 → :443, 🚫 198.51.100.9 → :22 … no inbound rule matches — dropped (the sender sees a timeout), ✅ 203.0.113.5 → :22 (office चा laptop), आणि ✅ reply 443 → 198.51.100.9:51000 sg-web: reply to a remembered conversation — stateful, no rule needed. NACL चा भाग: without an ephemeral-port rule → request आत ✅, reply बाहेर 🚫 (acl-public outbound: no rule matches → the final * DENY); with 1024–65535 out → reply बाहेर ✅ (acl-public outbound rule 110: ALLOW). तुमचा snippet 10.0.1.25 साठी (True, "sg-web: inbound rule '80 from the VPC'") आणि बाहेरच्या address साठी drop छापतो; मग 198.51.100.9 (False, 'acl-public inbound rule 90: DENY'), 192.0.2.44 (True, 'acl-public inbound rule 100: ALLOW') आणि, 8080 साठी, the final * DENY.

🏁 तुम्ही आत्ताच काय सिद्ध केले

तुम्ही प्रत्येक packet चे भाकीत केले: पाहुण्यांची यादी संभाषणे लक्षात ठेवते आणि विंगचे दार ठेवत नाही, NACL चा निर्णय नियमांचा क्रम ठरवतो, आणि न जुळलेले सगळे शांतपणे drop होते.

⚠️ नेहमीच्या चुका

22 किंवा 3389 0.0.0.0/0 साठी उघडे — Session Manager (धडा 06) वापरा, किंवा तुमचा स्वतःचा /32
outbound ephemeral-port नियम नसलेला custom NACL — requests पोहोचतात, replies मरतात, pages अडकतात
ज्या ALLOW वर मात करायची होती त्याच्या नंतरचा क्रमांक असलेला DENY NACL नियम
SG reference पुरेसा असताना CIDRs लिहिणे ("load balancer च्या SG कडून 80 allow करा")
timeout ला "app बंद आहे" असे समजणे — आधी SG, NACL आणि routes तपासा

🏭 प्रत्यक्ष वापरात हे का महत्त्वाचे: security reviews आणि AWS Security Hub जगासाठी administrative ports उघडे असलेला कोणताही SG दाखवून देतात. ठरलेली रचना: load balancer चा SG internet कडून 443 घेतो, डेस्कचा SG फक्त load balancer च्या SG कडून traffic घेतो, आणि संपूर्ण subnet साठी block लागत नसेल तर NACLs default च्या जवळच राहतात.

⏭️ पुढे

पाहुण्यांची यादी ठरली. आता: काही दुरुस्त करायला तुम्ही डेस्कपर्यंत कसे पोहोचता? एक चावी, एका मिनिटाचा पास, किंवा दारच नाही — connecting.

git checkout lesson-06-connecting

🧍 Lesson 05 — Networking — security groups & NACLs: the guest list and the wing door

📍 You are here: Lesson 05 of 12 · Previous: lesson-04-storage · Next: lesson-06-connecting

📦 What's in this branch

Lessons 01–04, plus the two firewalls every packet meets: the security group (the guest list at the desk — stateful) and the network ACL (the rules on the wing door — stateless), both as code in ec2/sg.py that you can send packets through.

🧒 Explain like I'm 5

The desks sit in a wing of the building (a subnet), inside the school's own grounds (the VPC).

At the wing door 🚪 stands a rule board (the network ACL). It checks every person walking in and every person walking out, reading the rules from the top — rule 90, rule 100, rule 110 — and the first rule that matches decides. It has a terrible memory: if a visitor walked in a minute ago, and their answer comes walking out, the board checks the answer as a stranger. No rule for it? Stopped.

At each desk stands a monitor with a guest list 🧍 (the security group). The list only says who may come in — "anyone for the web page on 443", "the office laptop for 22". It has a perfect memory: if it let a visitor in, the reply goes back out, no questions asked. And it never shouts "go away" — a stranger is simply ignored, and waits until they give up (a timeout).

🗺️ Diagram

flowchart LR
    visitor["🌍 198.51.100.9:51000"]
    nacl["🚪 NACL on the subnet — stateless<br/>100 ALLOW 443 · 200 DENY 22 · * DENY"]
    sg["🧍 security group on the desk — stateful<br/>443 from anywhere · 22 from 203.0.113.5/32"]
    desk["🖥️ web desk :443"]
    visitor -->|"1 in :443"| nacl -->|"2"| sg -->|"3"| desk
    desk -->|"4 reply to :51000"| sg
    sg -->|"5 remembered → allowed"| nacl
    back["NACL outbound needs 1024–65535<br/>without it → * DENY → the page hangs"]
    nacl -.->|"6"| back

🗺️ Drawn version + a lab: https://school-edh.pages.dev/ec2/lesson-diagrams.html#l05

❓ What

VPC and subnets — your private network in a Region; each subnet lives in one AZ. A public subnet has a route to an Internet Gateway; a private subnet does not (it reaches out through a NAT gateway, if at all).
Security group (SG) — attached to an instance's network interface. Allow rules only (no deny), for inbound and outbound. Stateful: the reply to an allowed request is allowed automatically. A new SG allows nothing in and everything out. A rule's source can be a CIDR (203.0.113.5/32) or another security group ("anything wearing the load balancer's SG" — lesson 10).
Network ACL (NACL) — attached to a subnet. Numbered allow and deny rules, checked lowest number first; the first match wins; a final * rule denies everything else. Stateless: replies are separate packets and need their own rule — usually the ephemeral ports 1024–65535 outbound. The default NACL allows everything; a new custom NACL denies everything until you add rules.
Dropped vs refused — an SG or NACL drop looks like a timeout. "Connection refused" means the packet arrived and nothing was listening on that port — a different problem.

🤔 Why

Because the network is the front door to every desk, and most EC2 break-ins start with a rule like "port 22 from 0.0.0.0/0". And because the two layers fail in opposite ways: SGs are easy to get right and easy to open too wide; NACLs are easy to forget, and a missing reply rule makes pages hang with no error anywhere.

🔧 How (in this repo)

ec2/sg.py has SecurityGroup (with receive(), which remembers the conversation, and reply()) and NetworkACL (rules sorted by number, first match wins, then the final deny). network() in ec2/demo.py sends three visitors to a web desk's SG, lets one reply out, then runs the same request through a NACL with and without the ephemeral-port rule. Tests L05 in ec2/test_ec2.py pin all three behaviours. It is a teaching model: real SGs and NACLs also match protocols like ICMP, IPv6 ranges and prefix lists.

🧪 Try it

python3 ec2/demo.py network
python3 - <<'EOF'
import sys; sys.path.insert(0, "ec2")
from sg import SecurityGroup, NetworkACL
# the web desk only takes port 80, and only from inside the VPC (where the load balancer lives)
web = SecurityGroup("sg-web", [("tcp", (80, 80), "10.0.0.0/16", "80 from the VPC")])
for src in ("10.0.1.25", "198.51.100.9"):
    print(web.receive("tcp", src, 40000, 80))
# NACL rules are checked lowest number first — a DENY at 90 beats the ALLOW at 100
acl = NetworkACL("acl-public",
    [(90, "deny", "all", (0, 65535), "198.51.100.0/24"), (100, "allow", "tcp", (443, 443), "0.0.0.0/0")],
    [(100, "allow", "tcp", (1024, 65535), "0.0.0.0/0")])
for src in ("198.51.100.9", "192.0.2.44"):
    print(src, acl.inbound_ok("tcp", 443, src))
print("port 8080 from anyone:", acl.inbound_ok("tcp", 8080, "192.0.2.44"))
EOF

On a real account (needs AWS credentials; use your own VPC, SG and NACL IDs):

aws ec2 create-security-group --group-name school-web --description "web desks" --vpc-id vpc-0123456789abcdef0
aws ec2 authorize-security-group-ingress --group-id sg-0123456789abcdef0 --protocol tcp --port 443 --cidr 0.0.0.0/0
aws ec2 authorize-security-group-ingress --group-id sg-0123456789abcdef0 --protocol tcp --port 80 --source-group sg-0fedcba9876543210
aws ec2 create-network-acl-entry --network-acl-id acl-0123456789abcdef0 --egress --rule-number 110 \
    --protocol tcp --port-range From=1024,To=65535 --cidr-block 0.0.0.0/0 --rule-action allow

✅ Verify — what you should see

The SG block prints ✅ 198.51.100.9 → :443, 🚫 198.51.100.9 → :22 … no inbound rule matches — dropped (the sender sees a timeout), ✅ 203.0.113.5 → :22 (the office laptop), and ✅ reply 443 → 198.51.100.9:51000 sg-web: reply to a remembered conversation — stateful, no rule needed. The NACL block: without an ephemeral-port rule → request in ✅, reply out 🚫 (acl-public outbound: no rule matches → the final * DENY); with 1024–65535 out → reply out ✅ (acl-public outbound rule 110: ALLOW). Your snippet prints (True, "sg-web: inbound rule '80 from the VPC'") for 10.0.1.25 and a drop for the outside address; then 198.51.100.9 (False, 'acl-public inbound rule 90: DENY'), 192.0.2.44 (True, 'acl-public inbound rule 100: ALLOW') and, for 8080, the final * DENY.

🏁 What you just proved

You predicted every packet: the guest list remembers conversations and the wing door does not, rule order decides a NACL, and anything unmatched is silently dropped.

⚠️ Common mistakes

22 or 3389 open to 0.0.0.0/0 — use Session Manager (lesson 06), or your own /32
a custom NACL with no outbound ephemeral-port rule — requests arrive, replies die, pages hang
a DENY NACL rule numbered after the ALLOW it was meant to beat
writing CIDRs where an SG reference would do ("allow 80 from the load balancer's SG")
reading a timeout as "the app is down" — check SG, NACL and routes first

🏭 Why this matters in production: security reviews and AWS Security Hub flag any SG with administrative ports open to the world. The standard shape: the load balancer's SG takes 443 from the internet, the desks' SG takes traffic only from the load balancer's SG, and NACLs stay close to default unless you need a subnet-wide block.

⏭️ Next

The guest list is set. Now: how do you get to the desk to fix something? A key, a one-minute pass, or no door at all — connecting.

git checkout lesson-06-connecting

← Previousstorage Next →connecting

This page is the lesson's README from the lesson-05-networking branch, shown here so the whole School stays on one site. Code files open on GitHub at the same branch.