Timeline for AWS Flowlog for Private Subnet Showing Routable IP's
Current License: CC BY-SA 4.0
8 events
| when toggle format | what | by | license | comment | |
|---|---|---|---|---|---|
| Oct 31, 2018 at 19:30 | vote | accept | kenlukas | ||
| Oct 31, 2018 at 19:30 | answer | added | kenlukas | timeline score: 1 | |
| Oct 22, 2018 at 14:29 | comment | added | kenlukas | @Daisetsu, correct on the first comment. Regarding the second comment, the host does not have a public IP associated to it. It is also in a subnet that routes through a NAT and is not connected directly to the Internet. | |
| Oct 20, 2018 at 3:00 | history | tweeted | twitter.com/StackSecurity/status/1053480930130780160 | ||
| Oct 20, 2018 at 0:50 | comment | added | Daisetsu | Looking at the flowlog documentation, it says "dstaddr:The destination IPv4 or IPv6 address. The IPv4 address of the network interface is always its private IPv4 address." This means the 10.X.X.X IP you're seeing in your flow log for the destaddr is the local IP for that host, but there could be a public IP also associated with that host. You may want to check if that's the case. If so, the flow log is showing that your security groups are correctly preventing traffic from those public IPs. | |
| Oct 20, 2018 at 0:41 | comment | added | Daisetsu | Ok, so you're seeing traffic ostensibly from public IPs attempting to contact hosts in your private subnet, which has no direct internet access, other than through a bastion host that separates your public/private subnet, and filters traffic only allowing TCP Port 22 from a specific IP. Right? | |
| Oct 19, 2018 at 17:24 | history | edited | kenlukas | CC BY-SA 4.0 |
redacted some data
|
| Oct 19, 2018 at 16:55 | history | asked | kenlukas | CC BY-SA 4.0 |