1

I configue inbound rules (under Services –> EC2 –> Instances –> Security Groups) is as follows.

# Type, Protocol,     Port Range, Source
All TCP,     TCP,     0-65535,    0.0.0.0/0 (anywhere)
All UDP,     UDP,     443,        0.0.0.0/0 (anywhere)
All IMCP,    ICMP,    0-65535,    0.0.0.0/0 (anywhere)

as shown below.

enter image description here

anywhere is too risky. How do I configure the inbound rules properly to improve security?

SparkAndShine
  • 17,001
  • 22
  • 90
  • 134

1 Answers1

2

Your VPN security group is wide open. If you are using IpSec, you need to open only UDP 500 and UDP 4500 for traffic from the other end. For example, you want to connect two VPCs. If the VPN address on the other side is 172.217.4.174, then allow UDP 500 and UDP 4500 from 172.217.4.174. If you want to allow traffic from another VPN, add another set of rules allowing traffic from that VPN.

enter image description here

helloV
  • 50,176
  • 7
  • 137
  • 145