Skip to main content

MODULE 6 - Network Security and VPC Troubleshooting

Overview​

This module delves into AWS network security and VPC troubleshooting techniques. You will learn the difference between Security Groups and NACLs, and how to diagnose connectivity issues.

Learning Objectives​

  • Differentiate Security Groups and NACLs
  • Configure network security rules
  • Diagnose VPC connectivity issues
  • Apply the principle of least privilege

Weekly Content​

Security Groups vs NACLs​

┌─────────────────────────────────────────────────────────────┐
│            SECURITY GROUPS vs NACLs                          │
├─────────────────────────────────────────────────────────────┤
│                                                              │
│              NACL (Network ACL)                              │
│              Level: SUBNET                                   │
│   ┌─────────────────────────────────────────────────────┐   │
│   │                                                      │   │
│   │   ┌─────────────────────────────────────────────┐   │   │
│   │   │        Security Group                        │   │   │
│   │   │        Level: INSTANCE                       │   │   │
│   │   │                                              │   │   │
│   │   │        ┌──────────────────────┐             │   │   │
│   │   │        │     EC2 Instance     │             │   │   │
│   │   │        └──────────────────────┘             │   │   │
│   │   │                                              │   │   │
│   │   └─────────────────────────────────────────────┘   │   │
│   │                                                      │   │
│   └─────────────────────────────────────────────────────┘   │
│                                                              │
└─────────────────────────────────────────────────────────────┘

Comparison:
┌──────────────────┬─────────────────────┬────────────────────┐
│ Criterion        │ Security Group      │ NACL               │
├──────────────────┼─────────────────────┼────────────────────┤
│ Level            │ Instance            │ Subnet             │
│ State            │ Stateful            │ Stateless          │
│ Rules            │ ALLOW only          │ ALLOW and DENY     │
│ Order            │ All evaluated       │ By number          │
│ Default          │ Deny all inbound    │ Allow all          │
└──────────────────┴─────────────────────┴────────────────────┘

Network Troubleshooting Method​

STEP 1: Check the basics
├── Instance running?
├── Public IP assigned?
└── Service started on the instance?

STEP 2: Check security
├── Security Group (inbound rules)
├── NACL (inbound AND outbound rules)
└── OS firewall (iptables, Windows Firewall)

STEP 3: Check routing
├── Subnet Route Table
├── Internet Gateway attached
└── Route to IGW (0.0.0.0/0)

STEP 4: Test connectivity
├── From the instance: curl, ping
├── To the instance: telnet, nc
└── Logs: VPC Flow Logs, CloudWatch

Exercise: Case Studies​

Case 1: Inaccessible Web Server​

Symptom: http://Public-IP does not respond
The instance is running, Apache is started.

Analyze and propose solutions.

Case 2: Isolated Database​

Symptom: The web application cannot connect to MySQL
Both instances are in the same VPC.

Identify the checks to perform.

Case 3: Intermittent SSH​

Symptom: SSH works sometimes, times out other times
From the same source IP.

What are the possible causes?

Deliverable​

3 "probable cause" scenarios + corrective actions

For each scenario above:

  1. Cause hypotheses
  2. Verification tests
  3. Corrective actions
  4. Future prevention
  1. Security Groups vs NACL - Detailed comparison
  2. Network Troubleshooting - Diagnostic method
  3. Validation Quiz - 30 questions to validate your knowledge
  4. Lab: VPC Troubleshooting - Practical exercises

Next week: MODULE 7 - Web Publishing