Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Basically I need to be able to connect from one EC2 instance to another using SSH. I run the command ssh -i path-to-pem-file ec2-user@dns-address-of-ec2-instance, and it times out.

I set my security group to allow SSH inbound from the public IP address of my second EC2 instance, but it still doesn't work. I know that everything should be fine because when I set my SSH inbound traffic to "allow from anywhere" I can connect with no problems. Also I can connect to the EC2 instance from a home machine (I added my IP address to the security group) without any problems.

Obviously I can't leave my inbound traffic open to "allow from anywhere", but I can't seem to connect when I limit it to just the IP address of the second EC2 instance. Maybe the public IP address isn't what I should be putting into the security group?

I can't seem to ping it either; it just times out. Here is the result of ssh -vv -i path-to-pem-file ec2-user@dns-address-of-ec2-instance

OpenSSH_6.2p2, OpenSSL 1.0.1h-fips 5 Jun 2014
debug1: Reading configuration data /home/ec2-user/.ssh/config
debug1: Reading configuration data /etc/ssh/ssh_config
debug1: /etc/ssh/ssh_config line 50: Applying options for *
debug2: ssh_connect: needpriv 0
debug1: Connecting to dns-address [IP Address different from public ip] port 22.
debug1: connect to address [IP Address different from public ip] port 22: Connection timed out
ssh: connect to host dns-address port 22: Connection timed out
share|improve this question
up vote 8 down vote accepted

EC2 instances use an internal 10.X.X.X address (or other address if using a VPC), and traffic to their 'public' IP address is simply re-routed to the internal IP address. EC2 instances also use a different DNS server that is not publicly accessible. When you resolve the hostname of the other EC2 instance, because you're inside the AWS network, it gives you the instance's 10.X.X.X address instead of the public IP address. This prevents the traffic from having to go out to the internet and back in, which makes it faster.

Even if you could whitelist by IP address, this isn't a good idea as in EC2 classic mode, both your internal and public address can change. The proper solution is to whitelist by security group. You basically add a rule to the destination security group saying to allow port 22 from a specific origin security group.

If both instances are in the same account, you simply allow sg-1234abcd (where sg-1234abcd is the security group the origin instance is a member of). If they are in different accounts, include the account number, such as 111122223333/sg-1234abcd.
See documentation for additional information.

share|improve this answer
Perfect that is exactly what I was looking for! Works without a hitch! – Pompey Jul 21 '14 at 1:11

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.