Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I have two ec2 instances created in Amazon cloud, one with public IP(Elastic IP), and another with only private IP 172.31.5.151. Then, set security group to the instance with public IP to limit https inbound access like 172.31.5.151/32, allowing only private IP to the instance with public IP.

But it doesn't work. Access denied when https access from instance with private IP to instance with public IP. When I chanage the https inbound filter to 0.0.0.0/0, then everything works fine. The question is: how to set inbound filter for a private IP?

Thanks.

share|improve this question
    
I assume you are using VPC instances. Is the same security group associated with both instances? –  dusan.bajic Aug 26 '13 at 8:42

2 Answers 2

For information, if you are using VPC, you need to make the difference between security groups and Network ACLs

Can you describe more precisely what you are trying to achieve with these 2 instances ?

share|improve this answer
    
Thank you. In my case NACLs are not used. Only security group is used for access control. Now I have an instance with public IP, say 54.189.251.23, and an instace with private IP, say 172.31.5.151. I want to limit the https access to public IP. That is only 172.31.5.151 is allowed to connect to 54.189.251.23 in https. So, I add inbound rule 172.31.5.151/32 to the security group. It seems reasonable but doesn't work. Don't know why. –  david Aug 26 '13 at 9:29
    
Thank you for the update David, –  Douda Aug 27 '13 at 8:28
    
Thank you for the update David, I am pretty sure that your solution won't work as you are trying to communicate from instance with the private IP to hit your other Public IP instance. The security group won't recognize the private IP if you are not part of a VPC, hence the NACLs... The best workaround you would use is assign a public IP to your "private instance" and allow this public IP in your sec group. Let's have an example : "Public" instance = inst A "Private" instance = inst B assign a public IP to inst B = B.B.B.B allow the B.B.B.B/32 ip to your inst A secgr allow SSH or RDP –  Douda Aug 27 '13 at 8:35

If you can access (any) public IP from your "private" instance, it is either using NAT instance or has public IP assigned (by default if launched in default public subnet). In any case, when you try to hit your "public" instance, source IP (from the security group's point of view) is not your instance's private address, so you will need to grant access based on the public IP address. (To confirm this, add 0.0.0.0/0 to filter, connect to https, then check netstat or IIS logs for source IP address)

Perhaps simpler solution would be to access "public" instance using its private ip address.

share|improve this answer
    
Thank you. I forgot there is a NAT between these two instances. Great help. –  david Aug 27 '13 at 1:45

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.