If I block traffic via a security group, I assume I don't have to pay for it.

But if I block traffic via iptables installed on my server then I assume it would be me that pays for any incoming traffic I blocked.

Are there things iptables can do that a security group cannot?

I am asking because I am looking into mitigating DDoS attacks on my web server. Thanks.


One thing is for sure - if you use security groups, the filtered traffic never reaches your server, so it reduces the load the server needs to take to process firewall rules. This is important if you talk about DDoS.

The security groups seems to have just simple filtering rules, while with iptables you can do really fancy things. But do you need them? Personally I would filter as much as possible with security groups and then make next stage on iptables if you need something more sophisticated than security groups allows. Nothing prevents you also from setting the same filters on both - you would be then double protected ;-)

  • In addition, when you have several instances as part of a security group and then you make a change to that group's rules it instantly affects all those instances. With iptables, you would need to manually update the rules on each instance and hope you don't fat-finger something along the way. – Daemon of Chaos Oct 4 '12 at 19:30

On Amazon EC2, you are not charged for incoming traffic. You are only charged for outgoing traffic. src: http://aws.amazon.com/ec2/pricing/#DataTransfer

One thing to know is that you cannot add or remove a security group to a running instance. You can however change the rules in the security group you used for that instance.

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.