Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Amazon's load balancers have a network security policy which swallows ICMP packets for both ping and traceroute. It is listed as security group amazon-elb/amazon-elb-sg. Personally I find these tools pretty helpful in diagnosing problems, so I'd like to be able to use them on my service. I'd rather the load balancer either responds to these requests or forwards them.

Is there any way to change the security group settings on an ELB? Or any other way to verify IP connectivity to the ELB?


To be clear, I see no way in the AWS console to either set the SG on a newly created ELB, nor to change the SG on an existing ELB.

share|improve this question

2 Answers 2

up vote 4 down vote accepted

This is possible in a VPC, but not in stock EC2.

share|improve this answer

Yes, go into your security group settings and permit incoming ICMP traffic on the one that is assigned to your ELB. Security groups work the same whether they're assigned to an ELB or EC2 instance.

I just tested and confirmed:

[jjbegin@bane ~]$ ping elb01-2026631704.us-east-1.elb.amazonaws.com 
PING elb01-2026631704.us-east-1.elb.amazonaws.com ( 56(84) bytes of data.
64 bytes from ec2-107-23-23-138.compute-1.amazonaws.com ( icmp_seq=1 ttl=51 time=36.2 ms
64 bytes from ec2-107-23-23-138.compute-1.amazonaws.com ( icmp_seq=2 ttl=51 time=35.9 ms
--- elb01-2026631704.us-east-1.elb.amazonaws.com ping statistics ---
2 packets transmitted, 2 received, 0% packet loss, time 1473ms
rtt min/avg/max/mdev = 35.985/36.121/36.258/0.233 ms
[jjbegin@bane ~]$ 
share|improve this answer
My ELB has a security group which I do not own. It is owned by "amazon-elb" and I see neither an option to change the security group nor an option to set the security group when I create a new ELB. –  Leopd Jan 22 '13 at 18:23
You must be using Elastic Beanstalk. In that case, there is no way to adjust the security group settings on the ELB's security groups. And you can't add/remove a security group unless you're using a VPC. What are you're trying to do? Monitor uptime? –  jamieb Jan 22 '13 at 18:31
I'm not using beanstalk. I'm trying to figure out what's wrong when things go wrong. –  Leopd Jan 22 '13 at 19:17
You don't see something like this? i.imgur.com/fFdqvEA.png –  jamieb Jan 22 '13 at 19:22
I do not. i.imgur.com/dQDy9jr.png –  Leopd Jan 22 '13 at 20:00

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.