Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

At the moment, because it isn't possible to specify a security group from another region when allowing port access using amazon ec2's security groups, we have had to insert each individual IP into the security group that it needs access to. I can see this process becoming difficult to keep track of (it kind of already has).

My idea was to do something similar to what you can do between to Amazon VPCs (we can't switch to VPCs right now becauase the migration would be a little much at the moment), so have one server in each region acting as a gateway, where all requests from cross region servers come in. This gateway would then redirect the request to the proper endpoint. This way the security groups would only need one IP for cross region servers, rather than 1 per server.

Is this a valid technique? Are there other methods that might be better?

share|improve this question

1 Answer 1

up vote 2 down vote accepted

We just recently tackled this same issue in our (mainly) VPC environment. We have VPC instances running in us-east-1, us-west-1, and us-west-2. Here's the documentation from Amazon:


With the VPN solution above, the source address stays that of the VPC (private IP) or in your case EC2 (public IP). There is no NAT. Therefore, you would get no benefit from the VPN at all.

I think given that you do not have VPCs, you should not attempt this approach at this time. Rather, institute a switch to VPC for all new instances and then setup the VPNs and use them going forward.

share|improve this answer
this seems like an ordeal, but you are definitely right. –  tonyl7126 May 17 '13 at 3:42

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.