Hello and welcome back.
So let's now look at a different thing which is the Nuckolls the network access control lists.
Before I hit here let me go back to the dashboard so you can see here that we have to default network
access lists and these are for that to be.
So if you go in another region and you could check on that you can find only one because by default
you get one security group and one knuckler and one internet gateway in default VPC.
OK.
So you can click here and scroll down into security and then go into Nuckols here.
Either one will lead you to the same thing.
It's always advantageous that you put the tag for easier tracking.
So I would say custom PPC Michael.
And here it is default the PC of course I found out again through the attacks.
OK.
Now then it took control.
What's the difference between a security group and the network controllers.
The networks control list or the Nachle it operates at the subnet level.
So it's like the gate to the subnet.
Anything coming into the subnet is filtered anything going out of the subnet is filtered.
How about the traffic that is within the subnet.
If it doesn't cross the subnet boundary then I kill has nothing to do with it.
So security groups will be the way to control that.
So I have the default would be seen.
So I haven't.
Michael ID tags that we put here associated with three subnets which are the three subnets.
Exactly.
These are the default subnets that have been created by default in the three availabilities zones in
the Ohio region and that all of that is done automatically by us when you created the account default.
Yes it is the default because it's in the default Ribisi and it's created by default and we see the
BBC in the name of the BBC.
Great.
And if you're going to have some assassinations you'll find that original ones that were created that
31 0 31 16 31 32 inbound rules what is allowed by default.
Let's see.
So this is a default Nakul in a default PC.
Right.
So what do we have.
We have a rule number and that number is 100 all traffic.
And I'm talking about protocol.
All report range all sorts all allow.
So allow all the inbound traffic.
And what is this rule.
This rule is a default rule that you cannot change or delete.
Let's striked see here what what is the one that appears only this one can I delete it.
Yes you can have the other one the one that has the asterisk on the left side you cannot that's an explicit
deny any.
So in the security group there is an implicit deny any at the end you don't see it.
It's not here.
But if nothing is allowed for that for a specific traffic and then it hits the bottom it's going to
be denied.
One thing we did not mention is security or security will only allow traffic.
You cannot have an explicit denial.
You can only have allow or permit truth in that.
Not cool.
You should have here an ID for that.
So let's say 10 custom disappeared and fine for strange.
I'm going to put 22 source is I can do just for the sake of it.
Now any and what you want to do.
I have two options and nobody died.
So here you have the options in the security group you can only allow you can are denied.
So if anything is not allowed it will be denied.
But here you can have a rule that is allow a rule that is denied configured in the same knuckle.
OK.
So that's what we have here to save.
And this will be saved.
So here I have a new rule.
I removed the one that used to be 100 and I put this new.
Right.
OK.
Now if I want to add another rule what is the number that I should pick here.
So these are real numbers right.
Leave a gap so it'll be a set of commands that you leave 50 or 100 big numbers so you can if you want
to edit it later on you can insert tools in between.
So you always need to think that way when you configuring the rules here.
And of course you can and different rules.
And then at the end you just click safe.
And what did they remove from here.
I removed the rule that said 100.
And it was all source all allow.
That was the case all traffic all Port Orange.
So that's now.
Exactly.
It looks like that they feel fine about the default outbound.
And now remember we're looking at the default VBC default Michael outbound a lot everything.
And then the explosive device.
So this truly you cannot change deny or edit or do anything about it.
Right.
And the sudden association we talked about already let's look at the default not kill for the custom
of the PC.
Exactly the same in-bound allow everything outbound and everything.
So here is the inbound.
Here is the outbound they look exactly the same subnet associations.
Here is only one subnet Y because in the custom BPC I only had one subnet.
So now everything is allowed inbound and outbound for default get regardless what the BBC type is let's
create one that is custom let's put it in the custom PC and we'll call it custom Nakul custom BBC and
period.
Let's move to that one and see what we have.
Click on that one custom custom BPC.
What you have on the Mount.
Nothing is allowed.
I wanted the explicit denied.
Nothing is allowed.
How about the are.
Nothing is allowed.
OK so this is a custom Nakul in a custom VBC.
How about defending the default VPC will not do it.
It's the same.
So Nuckols default regardless of the VPC type is inbound and outbound.
All about Nuckols custom Nakul regardless what the BBC type is inbound and outbound all the night.
So you have to add that about security groups you create a custom to give it to you.
You are attached to an invite and easy to instance.
Nothing is allowed on say but outbound everything is allowed.
OK so a default default defaults pay attention if you're not using the default VPC because in the default
VBC everything is cool.
Security Groups everything from within the same security group is allowed in but outbound.
Everything is about Nuckols everything is allowed inbound and outbound.
That's the default Ribisi.
So we need to be careful especially if you're launching your clients or your environment in a default
VBC you need to be extra careful for the security because security is everything you're compromised
everything is compromised.
Life is not good.
Knuckles are state less different than the security groups.
So if something is allowed on the inbound What is the guarantee the same traffic will be allowed on
the outbound.
Nothing.
Zero.
It has to be explicitly allowed on the out but what if something is allowed on the inbound.
And now I have the response for the same thing.
Is it allowed.
No.
STATE less not stateful.
One more thing that I always get asked about the same question is it.
Let's see what we have to say.
Add another one.
I am going to add rule 120 and it's a custom ICMP rule and I want to define a call request here.
And the source is any.
So in this subnet this is it.
Now we're talking about the subnet left right.
If anything is coming into the subnet from anywhere and the type of the traffic was ICMP and it is a
request or someone from the outside is trying to ICMP ping something inside the subnet.
This is allowed.
I can of course deny it as well.
OK.
This is allowed.
So this is something coming from the outside going into the subnet a request is allowed.
Is there any guarantee that if ICMP request is coming from outside from within the submit to the outside
would it be allowed.
Let's check for let's say this one but I have nothing.
So despite the fact I have this I have nothing allowed here.
Is it stateful.
No.
So that means if there is no explicit rule here it is denied.
So please if you get in the exam if you are going through the guided practice and you have a database
able to ping a web server that means the ICMP echo request when it comes out from the database is allowed
through the security group on the database outbound allowed from the subnet of the database.
Outbound comes into that not kill or the subnet of that web inbound that is ICMP echo request.
OK.
This is successful.
So if you request a call reply Everything is fine.
How about.
So this is finished.
Now I'm trying to ping from the web to the database and it's not working.
I get a lot of questions.
How come it's not working.
ICMP was allowed from the Debby's too.
What that means from where it is is also allowed.
No it's not.
It doesn't mean it's also allowed because as you can see here the Nakheel can denied a request from
Web to database but allowed from databases to have and it can allow it could apply from Web to database.
But then I would reply from the as to where this is directional.
The security groups and the Nikhil's are directional so it is very important to understand from where
to where.
And then you put the rules in the path and that Adem traffic needs to be defined on that as well because
security groups are fine if it is allowed forward returned will be allowed automatically regardless
what the rules are.
OK.
So keep that in your mind.
All right let's take a break now and I will see you after the.