Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I know its possible to create a security group to prevent access from all machines, but how do I restrict this to only users from my LAN. The problem is everytime we re-boot our systems, the IP address changes even though we have static internal IP(s) in the 192.168.1.x range.

share|improve this question
up vote 2 down vote accepted

Amazon offers 'Virtual Private Cloud' - essentially a private isolated network, and a VPN gateway that you can use for secure communication to the VPC. Sounds like what you are looking for. Alternatively, it is possible to setup OpenVPN between an external server and EC2, and/or between multiple EC2 instances

share|improve this answer
While your answer is fitting, copying and pasting someone else's comment from another question, verbatim and without attribution, doesn't make for a great start on this site. That aside, VPC will let you place your instance(s) on a private subnet and (for a fee) can be configured to act as an extension of your LAN. OpenVPN connections tend to drop now and again, and do not offer the same performance, but are free. With one instance, restricting access to the LAN's public IP should be simpler and equally effective. – cyberx86 Dec 9 '11 at 4:37
My apologies cyberx86, I should have attributed it to you. I had both windows open, and had just read your answer and it applied to this, so instead of rewriting the same thing I just c/p'd. In the future if something like this occurs, I will definitely add attribution and a link back. New to the site, wasn't aware of this. – Kevin Dec 9 '11 at 6:59

The Security Group only cares about your public IP address, not the private IP address of the machines in your LAN.

If you have a static public IP address, you can set your EC2 Security Group to allow traffic on that. That public IP is what Amazon is going to see, not the 192.168.1.x address.

If your public IP is dynamic, well, get a static one.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.