4 ms·
By default, Amazon uses stateless firewall. It means that by default it's not tracking connections.
by john37386 8y ago
By default, Amazon uses stateless firewall. It means that by default it's not tracking connections.
- spydum 8y agoI think you may be mistaken. Security Groups are stateful: https://docs.aws.amazon.com/vpc/latest/userguide/VPC_SecurityGroups.html https://docs.aws.amazon.com/vpc/latest/userguide/VPC_Securit... As suggested, it's very likely they hit the connection tracking limitation: https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/using-network-security.html#security-group-connection-tracking https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/using-ne... I've personally witnessed teams hit this specifically for DNS (usually for internal, where you have explicitly permitted src/dst).
- john37386 8y agoYep I mistaken Security groups with Network Acl. Thanks. It's in the best practices to not track dns for big systems. From powerdns https://doc.powerdns.com/recursor/performance.html https://doc.powerdns.com/recursor/performance.html
- gstaro 8y agoThx for the clarification. Had the same misconception