2

I have the following setup:

Instance A:
security group sgA
sgA inbound rules contains:
  Rule1: * All traffic - All protocols - All port ranges - Source: sgB
  Rule2: * SSH - TCP - port 22 - Source: 0.0.0.0/0

Instance B:
security group sgB

Both security groups have 'All traffic' enabled on 0.0.0.0/0 for outbound connections.

With this setup I can ssh from Instance B to Instance A. However, if I remove Rule 2 (the 0.0.0.0/0 rule), ssh now hangs and the machine does not respond to pings.

Am I misinterpreting how ssh access should work based on security groups?

Henry Henrinson
  • 121
  • 1
  • 3

2 Answers2

3

When you specify a security group as the source or destination for a rule, the rule affects all instances associated with the security group. Incoming traffic is allowed based on the private IP addresses of the instances that are associated with the source security group (and not the public IP or Elastic IP addresses).

In your example Host A would allow Host B on port 22 from Host B's private IP address. If you are using Host A's public IP address when you attempt to SSH from B, Host B will use either a NAT Gateway IP or its public IP. Because those IP's are not the private IP address they will not be allowed access.

I believe to get your configuration to work, you'll need to either:

  1. Use the private IP address when SSH'ing to Host A or
  2. Add the public IP address of Host B (or the NAT Gateway IP) to the Security Group source instead of (or in addition to) B's security group.

Reference

EC2 Security Groups

kenlukas
  • 3,101
  • 2
  • 16
  • 26
  • Interesting - that was a subtlety I wasn't aware of. Do you have any guidance on how to ssh via private IP addresses? – Henry Henrinson Nov 29 '19 at 12:08
  • Replace the public IP or DNS name with the private IP or private DNS. The routing should already be setup in the same VPC. `ssh -i @` – kenlukas Nov 29 '19 at 16:09
0

For establishing an SSH Connection the following must be there in the security group of the instance.

Security group for SSH ec2 Instance

The rule Rule1: All traffic - All protocols - All port ranges inclusive of the above ssh connection.

Dont confuse with the rule of opening up all the port.

Open only SSH Ports on both the security groups for all the subnets

If you found any furthur issue ping me

Manikandan Ram
  • 399
  • 2
  • 15