Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

If I block traffic via a security group, I assume I don't have to pay for it.

But if I block traffic via iptables installed on my server then I assume it would be me that pays for any incoming traffic I blocked.

Are there things iptables can do that a security group cannot?

I am asking because I am looking into mitigating DDoS attacks on my web server. Thanks.

share|improve this question
add comment

2 Answers 2

up vote 3 down vote accepted

One thing is for sure - if you use security groups, the filtered traffic never reaches your server, so it reduces the load the server needs to take to process firewall rules. This is important if you talk about DDoS.

The security groups seems to have just simple filtering rules, while with iptables you can do really fancy things. But do you need them? Personally I would filter as much as possible with security groups and then make next stage on iptables if you need something more sophisticated than security groups allows. Nothing prevents you also from setting the same filters on both - you would be then double protected ;-)

share|improve this answer
    
In addition, when you have several instances as part of a security group and then you make a change to that group's rules it instantly affects all those instances. With iptables, you would need to manually update the rules on each instance and hope you don't fat-finger something along the way. –  KayakJim Oct 4 '12 at 19:30
add comment

On Amazon EC2, you are not charged for incoming traffic. You are only charged for outgoing traffic. src: http://aws.amazon.com/ec2/pricing/#DataTransfer

One thing to know is that you cannot add or remove a security group to a running instance. You can however change the rules in the security group you used for that instance.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.