Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Amazon's load balancers have a network security policy which swallows ICMP packets for both ping and traceroute. It is listed as security group amazon-elb/amazon-elb-sg. Personally I find these tools pretty helpful in diagnosing problems, so I'd like to be able to use them on my service. I'd rather the load balancer either responds to these requests or forwards them.

Is there any way to change the security group settings on an ELB? Or any other way to verify IP connectivity to the ELB?


To be clear, I see no way in the AWS console to either set the SG on a newly created ELB, nor to change the SG on an existing ELB.

share|improve this question
up vote 4 down vote accepted

This is possible in a VPC, but not in stock EC2.

share|improve this answer
@vy32 This answer is from 2013, when it was entirely accurate. – ceejayoz Feb 6 at 21:28
This answer is no longer accurate. You need to go into the Security Groups and allow incoming ICMP traffic. – vy32 Feb 6 at 21:36

Yes, go into your security group settings and permit incoming ICMP traffic on the one that is assigned to your ELB. Security groups work the same whether they're assigned to an ELB or EC2 instance.

I just tested and confirmed:

[jjbegin@bane ~]$ ping 
PING ( 56(84) bytes of data.
64 bytes from ( icmp_seq=1 ttl=51 time=36.2 ms
64 bytes from ( icmp_seq=2 ttl=51 time=35.9 ms
--- ping statistics ---
2 packets transmitted, 2 received, 0% packet loss, time 1473ms
rtt min/avg/max/mdev = 35.985/36.121/36.258/0.233 ms
[jjbegin@bane ~]$ 
share|improve this answer
My ELB has a security group which I do not own. It is owned by "amazon-elb" and I see neither an option to change the security group nor an option to set the security group when I create a new ELB. – Leopd Jan 22 '13 at 18:23
You must be using Elastic Beanstalk. In that case, there is no way to adjust the security group settings on the ELB's security groups. And you can't add/remove a security group unless you're using a VPC. What are you're trying to do? Monitor uptime? – jamieb Jan 22 '13 at 18:31
I'm not using beanstalk. I'm trying to figure out what's wrong when things go wrong. – Leopd Jan 22 '13 at 19:17
You don't see something like this? – jamieb Jan 22 '13 at 19:22
I do not. – Leopd Jan 22 '13 at 20:00

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.