18

'm trying to create a security group that allows all inbound traffic originating from within my VPC. I thought I could simply specify my CIDR block, but that doesn't seem to work and requests fail unless I create a rule which allows inbound traffic from anywhere.

What's the right way to allow inbound traffic from any EC2 instance within the same VPC?

2
  • 1
    Security group entries referencing the CIDR block of the VPC or an appropriate subset should work perfectly, unless your VPC machines are trying to access each other using public IPs, in which case it doesn't (and shouldn't). Are you using the private address of the destination on internal requests? Nov 26, 2014 at 16:59
  • thanks @Michael-sqlbot I did notice that I was making that mistake earlier (using the public ip), but I am using the private and still having issues.
    – LuxuryMode
    Nov 26, 2014 at 17:56

1 Answer 1

23

Add the CIDR block of your VPC to your ingress rules of your security group.

You will also need to ensure that egress rules are configured for your other security groups to allow outbound traffic from your instances. Again, you can limit it to the same CIDR block.

For example, if your VPC CIDR block was 10.0.0.0/16, then:

  1. On your target security group, add an ingress rule on the desired port for 10.0.0.0/16.
  2. On all possible source security groups, add an egress rule on the desired port for 10.0.0.0/16.

However, to be more secure, I would recommend permitting traffic based on security group rather than CIDR block. For example:

  1. On your target security group, add an ingress rule on the desired port for the source security group.
  2. On your source security group, add an egress rule on the desire port for the target security group.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .