I am but a lowly (software) developer dabbling with setting up a network in AWS and am having trouble understanding the fundamentals of stateless firewalls, or Network ACLs as they're also referred to as. In short, rules meant to allow TCP responses seem to be very permissive, leading to security holes large enough to invalidate port filtering in general?
Say I have two subnets, A and B, in my network. Following the principle of Least Privilege, I am looking to limit traffic between the subnets to what is absolutely necessary, and this is implemented with a stateless firewall in between the subnets (aka NACLs in AWS VPCs) (as an extra layer of security on top of stateful Security Groups). I know that it is necessary for hosts in A to be able to connect to hosts in B on TCP port 9000.
That means TCP traffic from A to B on port 9000 needs to be allowed. In order for hosts in B to respond, we also need to allow traffic from B to A on all ports >=1024 (as I know devices in the network use ephemeral ports from 1024 and upwards).
These two rules now allow for any host in B to connect to A on on any port >=1024, as long as the ephemeral response port picked for the TCP request is 9000 (which allows for A to respond). Given enough connection attempts (i.e spamming connections until the OS randomly picks ephemeral port 9000) or control of the lower-level TCP functionality, a host in B will eventually be able to make any TCP request to A on any port >=1024.
Am I missing something? This somewhat catastrophic consequence of allowing return traffic for connections on a single port in one direction resulting in connections being possible in the opposite direction on almost any port seems like it almost invalidates the whole point of port filters in ACLs.
I would love some insight here from anyone with more expertise! Thanks.