Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Is there any way to create a desired topology of EC2 instances?

For example, can I create a 3 node topology of nodes A, B, C where C gets the public IP address and B and A are connected to it. Something like:

Internet <--> C <--> B <--> A

B and A only get private IP addresses and there is no way for the traffic to reach A before hitting B and C. This means I can install whatever I want to install on C and B to filter, cache etc.

I'm going through EC2 documentation but so far I have not seen anything that talks about it. I will really appreciate if anyone knows how to do this on EC2

share|improve this question

Sure. You can do this by chaining security groups (SGs). Security groups (SGs) can be thought of as ACCEPT rules for your member hosts.

Here's an excellent post describing some advanced SG usage from Dmitriy Samovskiy's Blog.

But here's a more directed response:

Let's assume you've got some port 80 service which is proxied. If each host had a different security group, you would define them like this:

  • Group C: Open to accept incoming connections from (the world) on port 80

  • Group B: Open to accept incoming connections from Group C on port 80.

  • Group A: Open to accept incoming connections from Group B on port 80.

Of course this means you won't be able to ssh in to any of these machines to manage them without also putting in accept rules for management... So be sure to have a plan for that in mind.. But it will provide the isolation you're looking for.

B and A will have public addresses, they just won't be accessible due to the limited SG rules.

Best of luck.

share|improve this answer
Thanks Joel. I did not know about this feature. However, on more thought, what I actually want to do is force traffic leaving from A to go via B without changing routing table at A. Something like a virtual network where B acts as a switch/middlebox. Any ideas if it is possible to do so? – Methos Jan 30 '11 at 21:52
If your using normal http proxies like haproxy, varnish, squid, etc. Then the return traffic will go out the same way it came in. Only when configuring "direct server return" can you bypass the proxies on the way back. – Joel K Jan 30 '11 at 23:16
Just add your ssh access to all three groups, or use ssh forwarding from C to B and then on to A if you want to keep them really isolated. – Skaperen Oct 19 '12 at 16:51

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.