-1

I am building the backend for a turn based gamed. My experience is mostly with a lamp stack; I've dabbled in nginx on a node side project.

I just read Scaling PHP Applications by Stephen Corona of Twit Pic. He recommends an nginx server over apache. He says that his ubuntu machine has 32768-61000 ports open.

On AWS do I need to modify my security to group to allow access to those ports? How do I ensure nginx is taking full advantage of this configuration?

Update:

I anticipate most of my requests being at port 443, which is why I was confused about his recommendation for opening more ports.

This is the reccomendation he makes

net.ipv4.ip_local_port_range

ip_local_port_range defines the range of usable ports on your system. On my stock ubuntu installation, it’s set to 32768-61000. Increase the range to allow for more connections. The number of avaliable ports limits the number of simultanious open connections. Remember, even after a connection is closed it still eats a port in the TIME_WAIT state (though we mitigate this with some settings below).

sysctl-wnet.ipv4.ip_local_port_range="10000 65535"

vi /etc/sysctl.d/haproxy-tuning.conf 
net.ipv4.ip_local_port_range=10000 65535
HarrisonJackson
  • 101
  • 2
  • 1
    Why would you need to open these ports? – Michael Hampton Jun 26 '13 at 03:34
  • What port(s) do the game services run on that external players need to connect to? Those are the ports you should open. – joeqwerty Jun 26 '13 at 03:39
  • How did you go with this. Can we help you further? – Drew Khoury Aug 06 '13 at 08:01
  • He may need to open those ports because they are the ephemeral ports used by many linux distributions. See http://docs.aws.amazon.com/AmazonVPC/latest/UserGuide/VPC_ACLs.html#VPC_ACLs_Ephemeral_Ports. For example, if you are using Opsworks within a non-default VPC, with EC2 instances in private subnets, it is important to open these ports(or some of them) to ensure that Opsworks can work properly. – Peter Kirby Apr 10 '14 at 23:34

2 Answers2

1

On AWS do I need to modify my security to group to allow access to those ports?

For incoming connections, yes. For connections that are initiated by your server, no.

By default, all outgoing ports are open and all incoming ports (except for SSH) are closed.

Incoming connections are those that are initiated by software that resides outside of your box. Outgoing connections are those that are initiated by software that resides inside your box, such as your linux kernel or NGINX on your instance.

How do I ensure nginx is taking full advantage of this configuration?

When you define ip_local_port_range, this setting defines ports for outgoing connections from your server. You would not want to open those ports (or any other ports that you don't need) for incoming connections in an AWS securtiy group. However, you need to open all ports on which NGINX is supposed to listen to incoming requests (typically the standard HTTP/HTTPS ports, hand-picked, but definitely not a port range).

Aside from that, you should run your servers in a VPC ("EC2 VPC" as opposed to "EC2 classic"). If you run your server in "EC2 classic" it is conceivable that some other user on the internal AWS network might succeed in port scanning your box if they happen to be in the same subnet. This is illegal on AWS and will get that users' accounts closed. For this very same reason, if you need to run a port scan, any penetration testing at all, or anything even remotely resembling a vulnerability scan, on your own AWS infrastructure, you absolutely have to ask Amazon for permission to do so or you will get yourself into some big trouble. You can obtain authorization for vulnerability scanning here: https://aws.amazon.com/security/penetration-testing/

NightKnight on Cloudinsidr.com
  • 49
  • 4
  • If using a network ACL for additional protection, you do need to open up the ephemeral port range. Some more info comparing security groups and ACLs here: http://docs.aws.amazon.com/AmazonVPC/latest/UserGuide/VPC_Security.html#VPC_Security_Comparison – Adam Sheehan Dec 24 '15 at 18:49
0

If you need to open ports for your application you can specify a port (or range of ports) in an AWS Security Group.

Create a new rule with the desired range, ie as per your example 32768-61000.

As to the question of if you need all these ports open, that comes down to how you architect your application. I suspect if you go down the route of many small EC2s behind a Load Balancer (a common setup for scalable solutions) then the advice of lots of open ports may not apply here.

AWS Load Balancers can handle lots of traffic and don't need lots of ports open.

Drew Khoury
  • 4,637
  • 8
  • 27
  • 28