---
title: Remote administration port access should be restricted to trusted networks
description: Datadog, the leading service for cloud-scale monitoring.
breadcrumbs: >-
  Docs > Datadog Security > OOTB Rules > Remote administration port access
  should be restricted to trusted networks
---

> For the complete documentation index, see [llms.txt](https://docs.datadoghq.com/llms.txt).

# Remote administration port access should be restricted to trusted networks
 
## Description{% #description %}

AWS network ACLs should allow ingress to remote server administration ports, such as SSH (port 22) and RDP (port 3389), only from trusted networks. A network ACL fails when an inbound ALLOW rule with source 0.0.0.0/0 and protocol TCP (6), UDP (17), or ALL (-1) has a port range that includes port 22 or 3389, unless an explicit DENY rule for that port from 0.0.0.0/0 has a lower rule number and therefore takes precedence. TCP and UDP are evaluated separately: the DENY rule must use the same protocol as the ALLOW rule or use ALL (-1), so an ALL (-1) ALLOW rule is blocked only when both TCP and UDP for the port are denied first. A network ACL whose entries were not collected fails, while one with an explicitly empty entry list passes. An entry without an `egress` flag, or with a null one, is treated as inbound. Network ACLs are evaluated regardless of subnet association, and environment-specific administration ports beyond 22 and 3389 are not evaluated.

## Remediation{% #remediation %}

In the [AWS VPC console](https://console.aws.amazon.com/vpc/home), select **Network ACLs**, choose the network ACL, open the **Inbound Rules** tab, and click **Edit inbound rules**. Change the rule's source to a range other than 0.0.0.0/0, delete the offending rule, or add an explicit DENY rule for ports 22 and 3389 from 0.0.0.0/0 with a lower rule number than any broader ALLOW rule, then click **Save**. See [Control subnet traffic with network access control lists](https://docs.aws.amazon.com/vpc/latest/userguide/vpc-network-acls.html) for details.

## References{% #references %}

- [Control subnet traffic with network access control lists](https://docs.aws.amazon.com/vpc/latest/userguide/vpc-network-acls.html)
- [Network ACL rules](https://docs.aws.amazon.com/vpc/latest/userguide/nacl-rules.html)
- [CIS Amazon Web Services Benchmarks](https://www.cisecurity.org/benchmark/amazon_web_services)