# Ensure no Network ACLs allow RDP port 3389 from the internet - Source: https://support.icompaas.com/support/solutions/articles/a_1793292203366631-ensure-no-network-acls-allow-rdp-port-3389-from-the-internet - Section: [Solutions](https://support.icompaas.com/support/solutions) › [AWS_Checks_v5.39.1](https://support.icompaas.com/support/solutions/c_1793285913477877) › [AWS Checks](https://support.icompaas.com/support/solutions/folders/f_1793287194371224) - Last updated: 2026-10-29 - Publisher: iCompaas, Inc. (https://www.icompaas.com) **Description** Ensure that no VPC network ACL allows inbound traffic from the Internet (0.0.0.0/0 or ::/0) to Microsoft Remote Desktop Protocol (RDP, TCP port 3389). Network ACLs control traffic at the subnet boundary, and their inbound rules are evaluated in order of rule number, starting with the lowest. **Rationale** Network ACLs are a subnet-level layer of defense in depth in front of security groups. If a network ACL allows RDP from the whole Internet, a single misconfigured security group or route can expose Windows instances to password spraying, brute-force attacks and RDP exploits, leading to data theft and ransomware. Denying RDP from 0.0.0.0/0 and ::/0 at the subnet boundary, and using a VPN, bastion host or AWS Systems Manager Session Manager, keeps this layer effective. **Impact** - Blocks RDP from the Internet at the subnet level, in addition to security groups - Reduces the impact of a misconfigured security group - Administrators currently connecting to RDP over the Internet will lose access and must use Session Manager, a VPN or a bastion host in an allowed range - Because network ACLs are stateless, a rule that is too broad can block legitimate traffic, so changes should be tested on a non-critical subnet first **Default Value** The default network ACL of a VPC allows all inbound traffic from 0.0.0.0/0 (rule 100), and also from ::/0 if the VPC has an IPv6 CIDR block, so it allows RDP from the Internet unless a deny rule is added. A newly created custom network ACL denies all inbound traffic until rules are added. **Pre-Requisites** - IAM permissions: ec2:DescribeNetworkAcls, ec2:CreateNetworkAclEntry, ec2:ReplaceNetworkAclEntry and ec2:DeleteNetworkAclEntry - The subnets associated with the network ACL and any trusted ranges that legitimately need RDP access - A free rule number lower than the rule that currently allows the traffic **Remediation** **Test Plan** **Console:** 1. Sign in to the AWS Management Console at [https://console.aws.amazon.com](https://console.aws.amazon.com/). 2. Open the Amazon VPC console and select **Network ACLs**. 3. Select a network ACL and open the **Inbound rules** tab. 4. Read the rules in order of rule number. For each source 0.0.0.0/0 and ::/0, find the first rule that matches port 3389, meaning: - type **All traffic**, or - protocol TCP with a port range that includes 3389. 5. Repeat for each network ACL in each region in use. 6. If that first matching rule is **Allow** for either source, follow the implementation steps. **CLI:** List the network ACLs: aws ec2 describe-network-acls --region --query "NetworkAcls\[\].\[NetworkAclId,VpcId,IsDefault\]" --output table List the inbound rules of a network ACL: aws ec2 describe-network-acls --region --network-acl-ids --query "NetworkAcls\[\].Entries\[?Egress==\\\`false\\\`\].\[RuleNumber,Protocol,RuleAction,CidrBlock,Ipv6CidrBlock,PortRange.From,PortRange.To\]" --output table The network ACL fails if, for source 0.0.0.0/0 or ::/0, the lowest-numbered rule with protocol -1 (all traffic), or protocol 6 (TCP) with a port range that includes 3389, has the action allow. **Implementation Steps** **Console:** 1. Sign in to the AWS Management Console at [https://console.aws.amazon.com](https://console.aws.amazon.com/). 2. Open the Amazon VPC console and select **Network ACLs**. 3. Select the network ACL found in the Test Plan and open the **Inbound rules** tab. 4. Choose **Edit inbound rules**. 5. If the matching allow rule is a rule only for port 3389, delete it. 6. If the matching allow rule is broader (for example **All traffic**), choose **Add new rule** and create a deny rule with a lower rule number: - **Type**: **Custom TCP**, **Port range**: 3389, - **Source**: 0.0.0.0/0, - **Allow/Deny**: **Deny**. 7. If the network ACL has an IPv6 allow rule, add the same deny rule with source ::/0. 8. If RDP is needed from trusted ranges, add allow rules for those ranges with rule numbers lower than the deny rules. 9. Choose **Save changes**. 10. Repeat for each affected network ACL in each region in use. **CLI:** The provided command deletes an existing rule; use it only when that rule number is a rule specifically for port 3389, because deleting a broad allow rule (such as rule 100 of the default network ACL) blocks all traffic it allowed. aws ec2 delete-network-acl-entry --network-acl-id --ingress --rule-number In most cases, add deny rules for port 3389 with a rule number lower than the allow rule instead (one for IPv4 and one for IPv6): aws ec2 create-network-acl-entry --network-acl-id --ingress --rule-number --protocol 6 --port-range From=3389,To=3389 --cidr-block 0.0.0.0/0 --rule-action deny aws ec2 create-network-acl-entry --network-acl-id --ingress --rule-number --protocol 6 --port-range From=3389,To=3389 --ipv6-cidr-block ::/0 --rule-action deny **Backout Plan** Before making changes, save the current network ACL rules: aws ec2 describe-network-acls --network-acl-ids > -backup.json To roll back: 1. Sign in to the AWS Management Console at [https://console.aws.amazon.com](https://console.aws.amazon.com/). 2. Open the Amazon VPC console, select **Network ACLs** and select the network ACL. 3. On the **Inbound rules** tab, choose **Edit inbound rules**. 4. Remove the deny rules that were added, and re-add any removed rules using the saved backup (rule number, type, port range, source and action). 5. Choose **Save changes**. **CLI:** aws ec2 delete-network-acl-entry --network-acl-id --ingress --rule-number Note: rolling back allows RDP from the Internet at the subnet level again. Use it only as a temporary measure. **Reference** - [https://docs.aws.amazon.com/vpc/latest/userguide/vpc-network-acls.html](https://docs.aws.amazon.com/vpc/latest/userguide/vpc-network-acls.html) - [https://docs.aws.amazon.com/vpc/latest/userguide/nacl-rules.html](https://docs.aws.amazon.com/vpc/latest/userguide/nacl-rules.html) - [https://docs.aws.amazon.com/cli/latest/reference/ec2/create-network-acl-entry.html](https://docs.aws.amazon.com/cli/latest/reference/ec2/create-network-acl-entry.html) ## Related compliance guidance - [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): Configuration checks like this one are the technical half of a SOC 2 / ISO 27001 programme — the guide shows where they fit, what else an auditor expects, and how to evidence them. - [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): ISO 27001 Annex A.8 (technological controls) is where cloud hardening evidence lands; the guide shows how to run the ISMS around it.