My problem is easily connecting via SSH to EC2 instances that do not have a public IP (i.e. db instances, web instances, etc.).

I found that one can use iptables PREROUTING chain to forward SSH traffic based on incoming port on the the server with a public IP. So I thought I could use my load balancer for forwarding SSH across my private instances. However, this seems like a pretty big security hole since my private instances now became potentially exposed to SSH-based attacks.

Is there any other way to conveniently SSH into EC2 instances with private IPs only?


I think you're describing Amazon VPC (Virtual Private Cloud). This Amazon service will allow you to accomplish your goal of securely accessing your virtual machines without public IPs by establishing an IPsec VPN tunnel. This solution works best when you've got a static IP or else you may have to rebuild the tunnel when your IP changes. The Amazon sales pitch is here: https://aws.amazon.com/vpc/

I've successfully used pfSense firewalls to establish tunnels using both static routing and BGP.


A bastion host would do what you need. It's basically an inwards proxy, you authenticate against that host, and from there you can connect to other machines.

The bastion is well secured, often locked down by IP, and you can require a VPN to connect to it if you want to.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.