3-1-4 Security Lists Explained

Key Concepts

• Security Lists
• Ingress Rules
• Egress Rules
• Default Security Lists
• Custom Security Lists

Security Lists

Security Lists in Oracle Cloud Infrastructure (OCI) are virtual firewalls for controlling traffic at the subnet level. They contain a set of ingress and egress rules that define what types of traffic are allowed to enter or leave the subnet. Each subnet in a Virtual Cloud Network (VCN) can be associated with one or more security lists.

Example: Think of a security list as a bouncer at a nightclub. The bouncer checks the guest list (ingress rules) to allow or deny entry and also monitors the exit (egress rules) to ensure no unauthorized people leave.

Ingress Rules

Ingress rules in a security list control incoming traffic to the resources within a subnet. Each ingress rule specifies the source of the traffic, the protocol, and the port range. By configuring ingress rules, you can allow or deny specific types of traffic from entering your subnet.

Example: If you want to allow only SSH traffic (port 22) from a specific IP address to access your compute instances, you would create an ingress rule that allows TCP traffic on port 22 from that IP address.

Egress Rules

Egress rules in a security list control outgoing traffic from the resources within a subnet. Each egress rule specifies the destination of the traffic, the protocol, and the port range. By configuring egress rules, you can allow or deny specific types of traffic from leaving your subnet.

Example: If you want to allow your compute instances to access a specific external database, you would create an egress rule that allows TCP traffic on the database's port (e.g., port 1521) to the database's IP address.

Default Security Lists

When you create a VCN, OCI automatically creates a default security list for each subnet. The default security list allows all traffic within the VCN and denies all traffic from outside the VCN. This provides a basic level of security but may not be sufficient for all use cases.

Example: The default security list is like a basic security system that allows family members (resources within the VCN) to move freely but locks the door to strangers (external traffic).

Custom Security Lists

Custom security lists allow you to define more granular rules for controlling traffic. You can create multiple custom security lists and associate them with different subnets to meet your specific security requirements. Custom security lists provide flexibility and control over network traffic.

Example: If you have a sensitive department (subnet) that requires stricter access controls, you can create a custom security list with specific ingress and egress rules to ensure only authorized traffic is allowed.

By understanding and implementing Security Lists, you can effectively control and secure the traffic within your Oracle Cloud Infrastructure environment, ensuring that your resources are protected according to your security policies.