Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

You can use ec2-authorize to specify what kind of traffic to allow to your ec2 instance. Is it still a good idea to run iptables, or is that introducing unnecessary complexity?

share|improve this question
add comment

2 Answers

up vote 5 down vote accepted

Some reasons why you might consider activating iptables:

  • can use to block outgoing trojans, eg block outgoing smtp 25, and you provide defense against spam trojans
  • what if the Amazon firewall is disactivated for some reason by Amazon by accident?
  • what if the instance is started with an inappropriate security group, or there is an issue with the security group's configuration?

Activating iptables provides defense in depth, and is easy to configure, eg with ufw:

sudo ufw default allow
sudo ufw enable
sudo ufw allow 22/tcp    # allow ssh
sudo ufw default deny

# sudo ufw allow 80/tcp   # uncomment this line to allow incoming http
# sudo ufw allow 443/tcp  # uncomment this line to allow incoming https

(note: this won't block outgoing smtp, but it does show that getting a basic iptables configuration setup is fairly painless, and then you can tweak this if you like vi /etc/ufw/*.rules)

share|improve this answer
add comment

I'd say it depends on how paranoid you are. I personally use a two-staged approach on my networks: there is a global firewall which blocks most bad stuff, and then each host runs some type of local firewall specific to its purpose in life.

It sounds like ec2-authorize is a lot like that per-host firewall. I'd configure it up and throw a few bad packets at it, and see what happens. I suspect it is sufficient.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.