In aws ec2, users can set up security groups which works like a firewall, usually, firewall work behind a gateway/nat server, however, I found that firewall in EC2 works in the LAN, too.
For example, users have too instances,
B: 10.108.33.18/26, according to the
netmask, they are in the same LAN, however, if I put those instances in different security groups(and the rules block visit from different sgs), the firewall works on them.
My questions is, I think firewall works only in Layer3/4, on which ip and port were. In the LAN, traffic between hosts goes throught Layer2(by MAC address). How could it be possible to implement such firewall in a LAN?
P.S. I checked the iptables on each host and I am sure it's stopped.