I have two ec2 instances created in Amazon cloud, one with public IP(Elastic IP), and another with only private IP Then, set security group to the instance with public IP to limit https inbound access like, allowing only private IP to the instance with public IP.

But it doesn't work. Access denied when https access from instance with private IP to instance with public IP. When I chanage the https inbound filter to, then everything works fine. The question is: how to set inbound filter for a private IP?


  • I assume you are using VPC instances. Is the same security group associated with both instances? – Dusan Bajic Aug 26 '13 at 8:42

For information, if you are using VPC, you need to make the difference between security groups and Network ACLs

Can you describe more precisely what you are trying to achieve with these 2 instances ?

  • Thank you. In my case NACLs are not used. Only security group is used for access control. Now I have an instance with public IP, say, and an instace with private IP, say I want to limit the https access to public IP. That is only is allowed to connect to in https. So, I add inbound rule to the security group. It seems reasonable but doesn't work. Don't know why. – david Aug 26 '13 at 9:29
  • Thank you for the update David, I am pretty sure that your solution won't work as you are trying to communicate from instance with the private IP to hit your other Public IP instance. The security group won't recognize the private IP if you are not part of a VPC, hence the NACLs... The best workaround you would use is assign a public IP to your "private instance" and allow this public IP in your sec group. Let's have an example : "Public" instance = inst A "Private" instance = inst B assign a public IP to inst B = B.B.B.B allow the B.B.B.B/32 ip to your inst A secgr allow SSH or RDP – Douda Aug 27 '13 at 8:35

If you can access (any) public IP from your "private" instance, it is either using NAT instance or has public IP assigned (by default if launched in default public subnet). In any case, when you try to hit your "public" instance, source IP (from the security group's point of view) is not your instance's private address, so you will need to grant access based on the public IP address. (To confirm this, add to filter, connect to https, then check netstat or IIS logs for source IP address)

Perhaps simpler solution would be to access "public" instance using its private ip address.

  • Thank you. I forgot there is a NAT between these two instances. Great help. – david Aug 27 '13 at 1:45

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.