Accessing Sendgrid SMTP endpoint through NACL

Question

Hi there!
I’m facing a weird issue trying to access Sendgrid SMTP endpoint from a service running in EKS. There is NACL associated with the subnets that NAT-GW is on.  
According to this:

```
# host smtp.sendgrid.net
smtp.sendgrid.net has address 54.228.39.88
smtp.sendgrid.net has address 18.197.194.208
smtp.sendgrid.net has address 52.57.139.126
smtp.sendgrid.net has address 108.128.229.184 
```
In the associated Network ACL, I have:
1. Egress rules that allow traffic to all four above IPs on TCP port 587
2. Ingress rules that allow traffic from all four above IPs on TCP port 1024-65535

Just to add: *I already have an ingress rule that allow inbound traffic from 0.0.0.0/0 on the ephemeral port range (1024-65535)*

But it doesn’t work, unless I allow Ingress traffic to `0.0.0.0/0 on port 587`. In stead of doing `0.0.0.0/0`, I also tried adding the same egress rules to ingress, without any joy. 
The ONLY thing that works is allowing traffic to 0.0.0.0/0 on port 587 and nothing else.  Does any know why I cannot restrict the Ingress rules to those 4 Sendgrid IPs?

-S

Gary Mclean · Answer

Thanks for the screen shots. Sounds like your Ephemeral port is 587 from your EKS service. I would use something like VPC flow logs to find the source port from your EKS service.

As NACLs are stateless, as you are configuring you will need ports open for the return traffic. See if you can figure out the source port from your EKS Service. Usually rule 400 would cover it but somethings afoot here.

You can create 4 rules as follows set to ALLOW to limit access on the INBOUND ACL if the Ephemeral port (Source) port is 587

| Type | Protocol | Port Range | Source |
| --- | --- | --- | --- |
| Custom TCP | TCP (6) | 587 | 54.228.39.88/32 |
| Custom TCP | TCP (6) | 587 | 18.197.194.208/32 |
| Custom TCP | TCP (6) | 587 | 52.57.139.126/32 |
| Custom TCP | TCP (6) | 587 | 108.128.229.184/32 |

Gary

Santanu · Answer

@Gary Mclean, didn't figure out how exactly to share, but here is the screenshots:

![Ingress NACL rules](/media/postImages/original/IMviXV6nyxRuSTnG8VNSmluw)

![Egress NACL rules](/media/postImages/original/IMNCU6uTO4ROaN6jK3d0kZrw)

Without the highlighted rule (#701) access to SMTP doesn't work.

-S

re:Post Agent · Answer

The issue you're experiencing with accessing the Sendgrid SMTP endpoint from your EKS service is likely related to how Network Access Control Lists (NACLs) handle return traffic for outbound connections.

When your service initiates an outbound connection to the Sendgrid SMTP endpoint on port 587, the return traffic from Sendgrid will use an ephemeral port (typically in the range of 1024-65535). This return traffic needs to be allowed by your NACL's inbound rules.

The reason why allowing traffic to 0.0.0.0/0 on port 587 works is that it's permitting all inbound traffic on that port, regardless of the source IP. However, this is not the ideal solution from a security standpoint.

To resolve this issue while maintaining better security practices, you should:

1. Keep your current egress rules allowing outbound traffic to the specific Sendgrid IP addresses on TCP port 587.

2. For the ingress rules, instead of specifying the Sendgrid IP addresses, you should allow inbound traffic from 0.0.0.0/0 (or your VPC CIDR if you want to be more restrictive) on the ephemeral port range (1024-65535). This will allow the return traffic from Sendgrid to reach your service.

3. Ensure that your security groups are also configured correctly to allow this traffic.

Remember that NACLs are stateless, meaning they don't automatically allow return traffic like security groups do. This is why you need to explicitly allow the inbound traffic on the ephemeral ports.

If you still experience issues after making these changes, you may need to investigate further, checking your VPC configuration, route tables, and ensuring that your NAT Gateway is properly set up to allow outbound internet access from your private subnets.  
**Sources**  
[Troubleshoot connection to AWS service endpoints from Linux | AWS re:Post](https://repost.aws/knowledge-center/linux-troubleshoot-service-endpoints)  
[Network ACLs for transit gateways in Amazon VPC Transit Gateways - Amazon VPC](https://docs.aws.amazon.com/vpc/latest/tgw/tgw-nacls.html)

Accessing Sendgrid SMTP endpoint through NACL

Add your answer

Relevant content

Type	Protocol	Port Range	Source
Custom TCP	TCP (6)	587	54.228.39.88/32
Custom TCP	TCP (6)	587	18.197.194.208/32
Custom TCP	TCP (6)	587	52.57.139.126/32
Custom TCP	TCP (6)	587	108.128.229.184/32