1

I try to change the SSH port from 22 to another port (218).

In AWS EC2, I shall add the rules in security group or in IP Tables?

Is there any guideline/references recommended for EC2 Security Group?

In earlier, my web unable to access - with basic security group 1. SSH - port 22 2. HTTP - port 80

with default IP tables (CentOS). The web back online when i turn off the iptables.

Suspect to be conflict between security group and iptables.

How to configure the security group with the CentOS iptables?

Anyone?

0

3 Answers 3

1

You should use either Security Groups or iptables - I advise you against using both at the same time. It makes administration more complex, error-prone and you'll often find your self in situation where things you expect to be working are having problems.

So, in short, turn of iptables:

chkconfig iptables off
service iptables stop
2
  • Thanks for the answer. But According to the online resources I found, it is better to have both on as security group actually help you to prevent the attack before it reach your server.
    – Carson Lee
    Dec 25, 2014 at 20:35
  • Keep it simple. My advice is to use only Security Groups. Two firewalls blocking exactly same ports won't increase your security but only complexity. Dec 26, 2014 at 11:34
1

Security groups in AWS are way more comfortable AND even better from the security point of view (as the traffic you want to block doesn't reach your instance at all). So turn off the iptables and configure the security groups as limited as you can.

0

EC2 security groups exist outside of the CentOS instance. IPTables runs inside the instance. The two are not mutually exclusive and will not conflict with one another. Using both means you have to maintain firewall rules in two places, but if you're okay with that, there's no harm in doing so.

To give you an example, if you want to allow SSH (TCP port 22) you have to allow TCP/22 in both IPTables and the EC2 security group.

5
  • thanks for replying. I am aware of that. Unfortunately, I have configure security group and iptables to allow HTTP: 80 but iptables seem rejecting it.
    – Carson Lee
    Dec 29, 2014 at 10:33
  • this is the command "iptables -A INPUT -p tcp -m tcp --dport 80 -j ACCEPT"
    – Carson Lee
    Dec 29, 2014 at 10:34
  • Try adding –m state --state NEW directly after your INPUT
    – user65237
    Dec 29, 2014 at 15:15
  • iptables -A INPUT –m state --state NEW -p tcp --dport 80 -j ACCEPT Bad argument –m' Try iptables -h' or 'iptables --help' for more information.
    – Carson Lee
    Dec 30, 2014 at 11:27
  • Don't copy and paste it, just type it. The character is different than the - character.
    – user65237
    Dec 30, 2014 at 14:57

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .