Multi-Tier Architecture: Firewalls, Ports, and TLS Security

In modern cloud system design and DevOps, securing multi-tier applications requires a defense-in-depth approach spanning network layers, host-level firewalls, and encrypted communication protocols. This chapter explores the operational mechanics of web server security, contrasting legacy SSL with modern TLS, configuring Linux host firewalls (UFW), managing cloud-level network security (AWS Security Groups), and dissecting the core triplet of network filtering: Protocols, IP Addresses, and Port Numbers.

1. Web Protocol Traffic: HTTP vs. HTTPS

When exposing a web application or reverse proxy like NGINX to the public internet, requests default to standard unencrypted HTTP unless configured otherwise.

• HTTP (Hypertext Transfer Protocol): Operates over plain text on Port 80. It provides no transport encryption, leaving data vulnerable to man-in-the-middle (MitM) inspection.
• HTTPS (HTTP Secure): Operates over an encrypted TLS tunnel on Port 443.

When navigating to a fresh server installation without an SSL/TLS certificate installed:

1. Entering https://<SERVER_IP> in a browser will result in a connection timeout or security warning because Port 443 is not actively listening or accepting encrypted handshakes.
2. Stripping the s and accessing http://<SERVER_IP> routes the traffic over Port 80, displaying the default "Welcome to NGINX" index page.

2. SSL vs. TLS: The Modern Encryption Standard

A common point of confusion in system design is the difference between SSL and TLS.

The Technological Evolution

• SSL (Secure Sockets Layer): The original encryption protocol developed for web browsers. All versions of SSL (SSL 1.0, 2.0, 3.0) are deprecated due to critical security vulnerabilities (e.g., POODLE, BEAST attacks).
• TLS (Transport Layer Security): The modern, cryptographically secure successor to SSL. Modern web platforms exclusively utilize TLS 1.2 or TLS 1.3.

Note: Despite TLS being the industry standard for over two decades, engineers colloquially refer to TLS certificates as "SSL certificates."

Real-Life Analogy

Think of calling TLS "SSL" like saying "Two twos are four" vs. "Two two four". Over time, industry professionals developed a shorthand habit of saying "SSL" even though the underlying technology executed in production is strictly TLS.

3. Host-Level Packet Filtering: UFW (Uncomplicated Firewall)

A firewall acts as a barricade or rule-engine placed between the network interface and internal services, inspecting and filtering incoming (ingress) and outgoing (egress) packets.

On Ubuntu Linux, the primary host-level firewall manager is UFW (Uncomplicated Firewall).

Common UFW Commands

To manage NGINX web traffic at the host operating system level:

# Update local package indexes
sudo apt update

# Install Certbot and its NGINX plugin for TLS certificate automation
sudo apt install certbot python3-certbot-nginx

# Allow both HTTP (Port 80) and HTTPS (Port 443) traffic through UFW
sudo ufw allow 'Nginx Full'

# Delete a specific rule if no longer needed
sudo ufw delete allow 'Nginx HTTP'

Conceptually: While engineers sometimes humorously refer to UFW as the "Universal Firewall," its official system utility name is Uncomplicated Firewall, acting as a simplified interface for Linux iptables or nftables.

4. Cloud-Level Firewall Architecture: AWS Security Groups

In cloud environments (such as AWS EC2), host-level firewalls (UFW) are reinforced by cloud-level virtual firewalls called Security Groups.

Ingress vs. Egress Security Rules

• Ingress Rules (Inbound): Controls incoming traffic reaching your EC2 instance from external clients or services.
• Egress Rules (Outbound): Controls outbound network packets originating from your instance reaching external destinations (e.g., external API calls, software package updates).

Security Groups operate at the hypervisor level outside the guest operating system, evaluating packet inspection rules with an implicit deny-all default posture for inbound connections. Firewall evaluation executes in $O(1)$ constant time per rule match.

5. The Three Pillars of Network Security Rules

To correctly route and secure network traffic across both host firewalls and cloud security groups, every rule requires three primary attributes:

1. Protocol: The standardized rule-set governing data transfer (e.g., TCP, UDP, ICMP).
2. IP Address: The origin or destination network address filtering traffic (e.g., 0.0.0.0/0 for universal public access, or a specific admin client IP like 203.0.113.5/32).
3. Port Number: The numerical endpoint mapping network traffic directly to an active operating system process listening on that socket.

6. Common Protocol & Port Mapping Matrix

The table below outlines common application protocols, their default assigned standard ports, and their production operational scope:

7. End-to-End Vertical Request Flow

Below is the vertical execution flow of an incoming HTTPS request traveling from an external web client through security barricades into an NGINX backend service:

Client Web Browser
   |
   | 1. Sends HTTPS Request (URL: https://example.com)
   v
Public Network Gateway
   |
   | 2. Routes packet to Server IP (Port 443)
   v
AWS Security Group (Cloud Layer)
   |
   
| 3. Checks Inbound Rule: Protocol=TCP, Port=443, Source=0.0.0.0/0
   |    [PASS] Traffic permitted through hypervisor
   v
Ubuntu OS UFW Firewall (Host Layer)
   |
   | 4. Evaluates UFW Rule: 'Nginx Full' (Port 443 TCP Allowed)
   |    [PASS] Traffic passed to OS kernel socket
   v
NGINX Web Server / Reverse Proxy
   |
   | 5. Terminates TLS connection using installed TLS Certificate
   | 6. Evaluates server block / routes request to application tier
   v
Application Core Execution

Summary and Key Takeaways

• SSL is Legacy, TLS is Production Standard: SSL versions 1.0–3.0 are completely deprecated and vulnerable. Modern secure web traffic exclusively relies on TLS (Transport Layer Security).
• Terminology Conventions: Industry engineers frequently use the term "SSL Certificate" as shorthand when referring to standard TLS Certificates.
• Dual Layer Firewall Strategy: Robust cloud architecture pairs host-level firewalls (UFW on Linux) with cloud infrastructure firewalls (AWS Security Groups).
• Ingress vs. Egress: Ingress filters incoming client requests; Egress controls outgoing connections originating from the internal application server.
• Security Rule Triplet: Every firewall rule requires explicit definition of a Protocol (e.g., TCP), an IP Address/CIDR Block (e.g., specific IP or 0.0.0.0/0), and a Port Number (e.g., 443).
• Standard Port Mappings:
  • Port 22: SSH remote system management.
  • Port 80: Plain-text HTTP web traffic.
  • Port 443: Encrypted HTTPS/TLS web traffic.
  • Port 465 / 587: Encrypted SMTP email transmission.
• Automated TLS Management: Tools like Certbot automate obtaining, validating, and renewing Let's Encrypt TLS certificates for web proxies like NGINX.