Amazon EC2 inbound filter for private IP

Question

I have two ec2 instances created in Amazon cloud, one with public IP(Elastic IP), and another with only private IP 172.31.5.151. Then, set security group to the instance with public IP to limit https inbound access like 172.31.5.151/32, allowing only private IP to the instance with public IP.

But it doesn't work. Access denied when https access from instance with private IP to instance with public IP. When I chanage the https inbound filter to 0.0.0.0/0, then everything works fine. The question is: how to set inbound filter for a private IP?

Thanks.

Answer 1

For information, if you are using VPC, you need to make the difference between security groups and Network ACLs

• consider the security group as your "instance firewall" (hence you can disable your instance software firewall such as internal iptables or Windows firewall)
• NACLs define the allowed/denied traffic within your subnet (http://docs.aws.amazon.com/AmazonVPC/latest/UserGuide/VPC_ACLs.html)

Can you describe more precisely what you are trying to achieve with these 2 instances ?

Answer 2

If you can access (any) public IP from your "private" instance, it is either using NAT instance or has public IP assigned (by default if launched in default public subnet). In any case, when you try to hit your "public" instance, source IP (from the security group's point of view) is not your instance's private address, so you will need to grant access based on the public IP address. (To confirm this, add 0.0.0.0/0 to filter, connect to https, then check netstat or IIS logs for source IP address)

Perhaps simpler solution would be to access "public" instance using its private ip address.