Take the 2-minute tour ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.

I know a certain range of IP addresses are causing problem with my server, 172.64.*.* what is the best way to block access to my Amazon EC2 instance? Is there a way to do this using security groups or is it better to do it with the firewall on the server itself?

share|improve this question
add comment

2 Answers

Both if possible, just in case.

Security groups are good because they are external to your host so the data never reach's you. They are not quite as configurable as most server based firewalls though.

Unfortunately, EC2 security groups can only "allow" services through a default deny policy. So if you are trying to block access to a publicly "allowed" service for a small IP range, building the allow rule for "the rest of the internet" is a bit more complex than just blocking an IP range. As you have specified a nice big chunk, the list of network ranges not including 172.64.0.0/16 is not too long:

0.0.0.0/1
128.0.0.0/3
160.0.0.0/5
168.0.0.0/6
172.0.0.0/10
173.0.0.0/8
174.0.0.0/7
176.0.0.0/4
192.0.0.0/3
224.0.0.0/3

This list would need to be added for your port(s). Then you can delete your 'allow all' rule for that port. If you have multiple ports you want to do this for that aren't contiguous, they list will need to go in multiple times. If you have multiple security groups this can quickly grow to be unmanageable.

Locally firewalling will also work. iptables is available on the default Amazon AMI, and all the linux distro's

sudo iptables -I INPUT -s 172.64.0.0/16 -j DROP

After adding your rules you'll need to save them, and ensure the iptables service starts at boot.

`sudo iptables-save > /etc/sysconfig/iptables-config`

The config file to save to may vary with distributions.

If you use a VPC for your instances you can specify "Network ACLS" that work on your subnet, and do provide both allow or deny rules.

share|improve this answer
    
this doesn't work anymore –  Kim Jong Woo Oct 13 '13 at 1:09
    
@KimJongWoo what doesn't work? I can't see iptables not working so are you referring to the large subnet allows in the security group? –  mtm Dec 24 '13 at 14:11
add comment

Please see this discussion page https://forums.aws.amazon.com/message.jspa?messageID=338053

share|improve this answer
add comment

We're looking for long answers that provide some explanation and context. Don't just give a one-line answer; explain why your answer is right, ideally with citations. Answers that don't include explanations may be removed.

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.