Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

In aws ec2, users can set up security groups which works like a firewall, usually, firewall work behind a gateway/nat server, however, I found that firewall in EC2 works in the LAN, too.

For example, users have too instances, A:, B:, according to the ip and netmask, they are in the same LAN, however, if I put those instances in different security groups(and the rules block visit from different sgs), the firewall works on them.

My questions is, I think firewall works only in Layer3/4, on which ip and port were. In the LAN, traffic between hosts goes throught Layer2(by MAC address). How could it be possible to implement such firewall in a LAN?

P.S. I checked the iptables on each host and I am sure it's stopped.

share|improve this question
up vote 0 down vote accepted

A whole bunch of the more advanced L3 switches support ACLs which every packet / frame would be checked against upon entry - no matter if it would have been going to the routing engine of the switch. This way, restrictions for hosts within the same broadcast domain can be implemented rather easily, although it should be noted that the processing of ACLs is typically not as sophisticated as you would expect from a stateful packet filter (mostly because the processing logic is implemented in circuitry instead of software).

This being said, as Amazon is virtualizing with Xen so they would be using virtual switching / Linux bridging rather heavily and likely would have implemented their filtering within the software layer - ebtables which is capable of doing IP filtering on bridged interfaces would be a good candidate for the under-the-hood processing.

share|improve this answer
Thanks, your answer is what I need and this helps me a lot. – ley Mar 8 '13 at 10:49
After a quick look, I think ebtables should work for me. Thanks a lot. – ley Mar 8 '13 at 10:56
@ley if the post helped you, please mark it "as an answer" by checking the mark underneath the vote count field. – the-wabbit Mar 8 '13 at 13:15
Sorry, didn't notice that at first. New to – ley Mar 8 '13 at 14:18

Recently, I've been reading the OpenStack nova implementations.

Then I found that if libvirt were used, the firewall above can be easily implemented using the nwfilter mechanism libvirt has implemented.

Detailed information can be found at, it explans how it was implemented, and as @syneticon-dj mentioned, it used a combination of ebtables, iptables and ip6tables.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.