Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I recently stumbled upon a firewall issue with my EC2 instance. The TCP port was made available to everyone via the EC2 Security Group, however there was still instance-side filtering using iptables. I figured if anything Security Groups are just a fancy API for IPTables. It turns out they're running completely exclusively from what I can tell. Is there any reason to use both? One firewall should be plenty and adding another layer of complexity seems to be a headache just waiting to happen.

In the meantime, I'm contemplating either opening up all ports in my Security Group and then doing all filtering via iptables, or the inverse, disable iptables and use Security Group filtering.

Any feedback on whether or not my logic here is flawed? Am I missing something critical?

share|improve this question
up vote 6 down vote accepted

The security groups add no load to your server - they are processed externally, and block traffic to and from your server, independent of your server. This provides an excellence first line of defense that is much more resilient than one residing on your server.

However, security groups are not state-sensitive, you cannot have them respond automatically to an attack for instance. IPTables are well suited to more dynamic rules - either adapting to certain scenarios, or providing finer grained conditional control.

Ideally you should use both to complement each other - block all the ports possible with your security group, and use IPTables to police the remaining ports and protect against attacks.

share|improve this answer

Think about the security group like a hardware firewall in a normal networking scenario. I guess you wouldn't really have to use both unless you had a special scenario, for example: you have a security group called webservers that controls access to web servers. You want to block an IP from hitting port 80 on one of those servers but not all of them. So what you would want to do is go into iptables on that one server and do the block, as opposed to doing it in the security group which would apply to all the servers in that security group...

share|improve this answer

They're both reasonably easy to set up, and having both set up provides protection from an exploit or flaw in one of them.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.