9

My public IP address changes every 24 hours which is normal, but my question is: how can I make it static or what setting do I need to change so I don't have to re-allow and recreate a new security group for my new public IP address in AWS EC2?

7
  • 5
    Changing IP addresses every day is not common at all, except in a few countries where it's misapprehended as a "privacy" measure, and elsewhere in a few broken ISPs. That said, if you're stuck with this and can't get the ISP to stop doing it, you can't really restrict anything to a single IP address in the security group. Jul 17, 2020 at 18:19
  • 12
    @MichaelHampton dynamic IP addresses is very normal and the very reason many dynamic DNS services have been very successful over the years. Im not sure why you think this is abnormal - a static IP address is very much the exception and has been for a long time, in-fact its often an up-sell item or reserved for business connections.
    – Moo
    Jul 18, 2020 at 9:45
  • 5
    What @MichaelHampton was saying is that the rate of reallocation is normally much lower than 24 hours. My ISP typically changes my IP once a year, if even that. Jul 18, 2020 at 12:40
  • 1
    @Moo I said, quote: "Changing IP addresses every day" is not normal, not that dynamic IP assignment is not normal. Jul 18, 2020 at 15:32
  • 2
    @MichaelHampton i beg to differ, for a lot of ISPs that is perfectly normal - Ive seen it a lot in the UK and here in NZ for example during my years on the internet.
    – Moo
    Jul 18, 2020 at 22:45

7 Answers 7

18

A dynamic IP address is fairly common in many countries. So is carrier grade NAT, which means many people share the same IP address.

You don't need to create a new security group; you just need to add your new IP address to the existing security group and ideally need to remove all others from the security group. There are scripts you can find online that automate this for you, such as this one. You could extend it to remove old IP addresses using the AWS CLI / SDK. An EC2 instance can have five security groups, I tend to have one dedicated to home IP on various ports, one for my CDN's IPs, and then a "misc" SG for other things. This is useful as SGs have a limit of around 50 rules per group, and keeping things together makes them easier to organise.

Alternately, if your IP addresses are all in a given CIDR range or set of ranges, you could add those to your security group.

Another option is to remove the IP address restriction, which decreases security somewhat, but if you keep your private key private maybe that's good enough. That would open you up to brute force login attempts, and if any vulnerabilities are found in SSH or SSH is poorly configured that could let people into your server, so I wouldn't recommend it but it is an option.

8

You can sidestep the open IP address issue by using AWS Systems Manager Session Manager.

It logs you in to your EC2 instances through the AWS CLI. How AWS routes your connection internally is a bit of a black box, but it does permit you to keep those ports closed to the public Internet.

To use things like scp or rsync, you can enable ssh connections through the AWS CLI following this documentation.

0
4

I'd avoid using another commercial service for a VPN, and instead either

  1. Run a VPN server like OpenVPN on your own EC2 instance in your VPC, or

  2. Since you're already paying for AWS services, use the AWS Client VPN https://docs.aws.amazon.com/vpn/latest/clientvpn-admin/what-is.html

Both will let you connect to your remote host securely, with certificates rather than passwords, and you can leave your security group allowing unrestricted access in on port 1194/udp.

Optionally you could lookup all the IPs owned by your ISP and add the entire blocks to your inbound security group.


Another option is to upgrade your residential grade ISP connection to one with static IPv4 addressing, at some cost, if they offer it, or change to an ISP that does.


Finally, consider IPv6 connectivity. This is relatively simple at the AWS side, but again depends on your ISP supporting it.... not all do.

2

Some commercial VPNs will offer a solution that gives your traffic a consistent network egress. I've used that solution commercially, especially as many workers previously connecting through the corporate network infrastructure transitioned to work from home arrangements but still needed access to the same cloud resources.

This is likely overkill for anything on the scale of a personal project.

0
0

2Xs a month AWS changes my IP Address - Now the client wants AWS to pay for the outage of 20 people 40 mins a month!

What is going on AWS???

2
  • If you have a new question, please ask it by clicking the Ask Question button. Include a link to this question if it helps provide context. - From Review
    – Dave M
    Apr 24, 2022 at 12:24
  • Your answer could be improved with additional supporting information. Please edit to add further details, such as citations or documentation, so that others can confirm that your answer is correct. You can find more information on how to write good answers in the help center.
    – Community Bot
    Apr 24, 2022 at 19:00
0

Good Day I might have another option for you

Feel free to use my powershell script for this .

The script detects your public ip and adds it to the inbound security group rules of dedicated RDP and SSH security groups .

If these groups do not exist , the script will create them and add it to the appropriate instances .

https://github.com/manuelh2410/public/blob/1/AWSIP_Linux_Win.ps1

Share

0

Feel free to use my powershell script for this .

The script detects your public ip and adds it to the inbound security group rules of dedicated RDP and SSH security groups .

If these groups do not exist , the script will create them and add it to the appropriate instances .

https://github.com/manuelh2410/public/blob/1/AWSIP_Linux_Win.ps1

Share

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .