Ephemeral ports
The example network ACL in the preceding section uses an ephemeral port range of 32768-65535. However, you might want to use a different range for your network ACLs depending on the type of client that you're using or with which you're communicating.
The client that initiates the request chooses the ephemeral port range. The range varies depending on the client's operating system.
-
Many Linux kernels (including the Amazon Linux kernel) use ports 32768-61000.
-
Requests originating from Elastic Load Balancing use ports 1024-65535.
-
Windows operating systems through Windows Server 2003 use ports 1025-5000.
-
Windows Server 2008 and later versions use ports 49152-65535.
-
A NAT gateway uses ports 1024-65535.
-
Amazon Lambda functions use ports 1024-65535.
For example, if a request comes into a web server in your VPC from a Windows 10 client on the internet, your network ACL must have an outbound rule to enable traffic destined for ports 49152-65535.
If an instance in your VPC is the client initiating a request, your network ACL must have an inbound rule to enable traffic destined for the ephemeral ports specific to the type of instance (Amazon Linux, Windows Server 2008, and so on).
In practice, to cover the different types of clients that might initiate traffic to public-facing instances in your VPC, you can open ephemeral ports 1024-65535. However, you can also add rules to the ACL to deny traffic on any malicious ports within that range. Ensure that you place the deny rules earlier in the table than the allow rules that open the wide range of ephemeral ports.