1

I have two EC2 instances in same regions. Lets call them instance-1 and instance-2. instance-1 has an Elastic IP address attached to it but instance-2 does not.

I want my instance-1 to allow inbound traffic from instance-2 in its iptables. I could assign an Elastic IP to instance-2 and add something like below to the INPUT chain.

ACCEPT     tcp  --  xx.xx.xx.xx         anywhere             tcp dpt:yyyy
ACCEPT     tcp  --  xx.xx.xx.xx         anywhere             tcp dpt:zzzz

Where xx.xx.xx.xx is Elastic IP of instance-2 and yyyy and zzzz are destination ports.

But since Amazon restricts the number -- five -- of Elastic IP addresses assigned to an account I don't want this instance to have an Elastic IP address.

My question is can I use internal IP address, in the form of 10.xx.xx.xx, provided by Amazon to instance-2 in iptables of instance-1?

A solution could be to stop using instance level iptables and use Security Groups provided by EC2. But I'm a little bit apprehensive about this. I feel it's better to protect the system from unknown inbound traffic at instance level as well as at security group(EC2 application) level.

4

The solution is to use an Amazon Web Services Virtual Private Cloud: http://aws.amazon.com/vpc/

You will be able to assign your own private IP address within your own cloud, and control all of the connectivity in and out of the cloud, bypassing the limitation on the number of elastic IP addresses.

It will take a little bit of reading to completely understand, but will pay off in the long run.

You should be able to use the internal IP address in your iptables even without using a VPC, but your internal IP address will be reassigned should you stop and restart your instance (or if Amazon does it for you ;-), so you would have to reconstruct your iptables with every instance stop. In a VPC you can assign your internal IP address.

  • +1. VPC removes a lot of pain from EC2 and comes with basically no downside. – ceejayoz Sep 5 '13 at 2:28

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.