0

Is there any way to create a desired topology of EC2 instances?

For example, can I create a 3 node topology of nodes A, B, C where C gets the public IP address and B and A are connected to it. Something like:

Internet <--> C <--> B <--> A

B and A only get private IP addresses and there is no way for the traffic to reach A before hitting B and C. This means I can install whatever I want to install on C and B to filter, cache etc.

I'm going through EC2 documentation but so far I have not seen anything that talks about it. I will really appreciate if anyone knows how to do this on EC2

1 Answer 1

1

Sure. You can do this by chaining security groups (SGs). Security groups (SGs) can be thought of as ACCEPT rules for your member hosts.

Here's an excellent post describing some advanced SG usage from Dmitriy Samovskiy's Blog.

But here's a more directed response:

Let's assume you've got some port 80 service which is proxied. If each host had a different security group, you would define them like this:

  • Group C: Open to accept incoming connections from 0.0.0.0/0 (the world) on port 80

  • Group B: Open to accept incoming connections from Group C on port 80.

  • Group A: Open to accept incoming connections from Group B on port 80.

Of course this means you won't be able to ssh in to any of these machines to manage them without also putting in accept rules for management... So be sure to have a plan for that in mind.. But it will provide the isolation you're looking for.

B and A will have public addresses, they just won't be accessible due to the limited SG rules.

Best of luck.

3
  • Thanks Joel. I did not know about this feature. However, on more thought, what I actually want to do is force traffic leaving from A to go via B without changing routing table at A. Something like a virtual network where B acts as a switch/middlebox. Any ideas if it is possible to do so?
    – Methos
    Jan 30, 2011 at 21:52
  • If your using normal http proxies like haproxy, varnish, squid, etc. Then the return traffic will go out the same way it came in. Only when configuring "direct server return" can you bypass the proxies on the way back.
    – Joel K
    Jan 30, 2011 at 23:16
  • Just add your ssh access to all three groups, or use ssh forwarding from C to B and then on to A if you want to keep them really isolated.
    – Skaperen
    Oct 19, 2012 at 16:51

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .