1

My objective:
To make my AWS Elastic Load Balancer hittable by only traffic from my ip.

What I have tried:

  • created a security group in EC2 security groups
  • set an inbound rule that allows all traffic from my ip [all, all, all, /32]
  • assigned this ELB the newly created security group
  • attempted to hit the elb from an ip outside myoffice

The results:
All traffic, even from ips other than mine could still hit my ELB (and thus get through to my app servers).

What am I doing wrong? How can I block inbound traffic to my ELB (and the EC2 instances behind it)?

Improve this question
3
  • So the only thing in your inbound rule is a Custom IP?
    – c4urself
    Jan 6, 2015 at 3:57
  • yes my inbound rule looks like so: All traffic All All <my.ip.goes.here>/32
    – mconlin
    Jan 6, 2015 at 4:08
  • 1
    Check and make sure your ELBs have only the one security group.
    – ceejayoz
    Apr 28, 2016 at 18:05

2 Answers 2

Reset to default
2

You need to create a security group on your app servers that only allows inbound traffic from the ELB security group.

As the docs say:

This feature involves two security groups—the source security group and a security group that defines the ingress rules for your back-end instance. To lock down traffic between your load balancer and your back-end instances, add or modify a rule to your back-end security group that limits ingress traffic so that it can come only from the Amazon EC2 source security group provided by the Elastic load Balancing.

Improve this answer
1
  • This will prevent someone from bypassing the ELB and going straight to the servers directly, but it won't fix OP's issue at all if the issue has been accurately described.
    – ceejayoz
    Apr 28, 2016 at 18:08
-2

Verify below.

1) Default security group of VPC if attached to the ELB, permitting 80 to any ?

2) No other SG should be attached to the ELB than what you have explicitly allowed for

3) Since you can only permit traffic in Security group and rest all will hit to implicit deny, there is another method to drop all traffic in the NACL of subnet where ELB was launched.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .