I have written a web hook for PayPal IPN and I only want to allow access from PayPal servers on Port 80/443 to the EC2 instance hosting the end point.

In the EC2 security group console I can only filter by IP/Range. This isn't adequate as PayPal say they change IP address randomly and without no notice, so one must use the hostnames.

I've seen answers here that recommend widening the IP Block etc but no real direct solution. One proposed solution was to update the Security Group using the AWS API.

Is this the best option? What I could do is have a scheduled task to compare the current IP that the PayPal host resolves to the last known IP address. If they are different, then update the AWS EC2 group.

I would run that task on the same machine, because hey, if the machine stops then access to the endpoint won't be available anyway.

Is this the most appropriate solution? I will do the same for my home where I have a similar problem.


Does the filtering have to be done at the AWS level. You could add an additional software firewall on the instance (or as another instance between the IGW and the instance), Pfsense should allow firewall blocking based on hostname.

  • To answer that, no it doesn't need to be done at AWS level but doing so would a reason I like AWS and the likes. Installing PF sense is a little overkill imho (inexperienced too). Would windows firewall be sufficient? It's a Win Server box. Thanks. – jim Dec 11 '15 at 7:21

Security groups don't do hostname filtering, only IP Ranges or other logical references within AWS.

As AWS offers an API for SGs you can update them as the IP Addresses change, though that method sounds a little too fragile for a production service.

There are many other options available, though they require doing a little more work. For example, setting up a proxy would allow you to control access via hostname for example.

AWS offers a detailed guide to installing and configuring squid here https://aws.amazon.com/articles/6884321864843201

This is a quick snippet to give you an idea of what's involved:

$ sudo vim /etc/squid/squid.conf

acl s3 dstdom_regex .*s3\.amazonaws\.com
acl s3 dstdom_regex .*s3\.ap-southeast-2\.amazonaws\.com
acl s3 dstdom_regex .*s3\.ap-southeast-1\.amazonaws\.com
http_access allow localnet s3

$ sudo service squid restart

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.