Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Good morning all.

We are currently build a SQL box on Amazon (currently MSSQL, but moving to MySQL soon...) and i have set the firewall in Amazon to only allow connections from our main network IP address and 2 other security groups on Amazon (web servers and worker roles). Anyway, it seems that this firewall rule is not working as planned... checking the SQL server logs i am getting a load of requests from other IP addresses trying to get in to the instance (trying to guess the SA password). this seems to be accounting for quite a lot of traffic and CPU usage...

So, what should i be doing to lock down my instance? I though that only allowing machines in my own security group and my own network would lock down a lot of this on a network level... Am i missing something?

share|improve this question
What OS version? Is the firewall turned on? What does your rule look like? Are you sure that there isn't another rule that is superceding yours? Need more info. – Tatas Mar 18 '11 at 13:56
Windows Server 2008 R2 at the moment, but will be moving to a Linux box soon. there are 3 rule sets: Web Servers, Worler Roles, SQL box. The Web Servers can talk to both the SQL and Worker Roles (all ports) and the workers can see the SQL box. The SQL box cant see anyone. The SQL box is open on port 1433 and RDP for our IP in the office. That is all. the SQL box is very locked down... no other rules i can see... – TiernanO Mar 18 '11 at 14:55
Is the firewall enabled? If so, for domain, public, etc.? – Tatas Mar 18 '11 at 15:06
windows firewall is enabled and is set to allow trafic for domain, public and private, but shouldent Amazon's Firewall block it before it hits windows? – TiernanO Mar 18 '11 at 15:42
Might be worth adding the output of ec2-describe-group and adding that in, if you want confirmation that the security groups are set up correctly. From personal experience I know it's easy to get the cidr address wrong! – Decado Mar 19 '11 at 9:19
up vote 0 down vote accepted

Presumably you are paying amazon for the service and support - they should be your first port of call if the firewall is not blocking connections.

If I was running a remote database, then I'd restrict access via a VPN as well as a firewall.

Although its just security by obscurity if the problem is just the amount of noise, then running the server on a non-standard port may help.

share|improve this answer
We are not paying Amazon for support, just for the service. Will give them a shout if an answer does not come up here... As for the Firewall and VPN part, It seems that Amazon's VPN setup is done so that you host a VPN server (Hardware or other) locally, and they connect... not the best option. as for the non standard port, that might help. i will try that. – TiernanO Mar 18 '11 at 14:56

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.