Menu
If I'm configuring UFW and also Amazon EC2 Security group, which will override the other, or do they both co-exist without any issues?
212
As AWS provides firewall/Security groups which are very efficient, I would say and advocate that it is not required to have a additional firewall program such as UFW.
Security is a shared responsibility between AWS and you. For more information, see Security in Amazon EC2. AWS provides security groups as one of the tools for securing your instances, and you need to configure them to meet your security needs.
By default, new security groups start with only an outbound rule that allows all traffic to leave the resource. You must add rules to enable any inbound traffic or to restrict the outbound traffic.
You can add or remove inbound and outbound rules for any default security group. You can't delete a default security group.
A firewall like UFW is running at the OS level, while Amazon Security Groups are running at the instance level. Traffic coming into the EC2 would first pass through the SG, and then be evaluated by UFW. Take a scenario where traffic is explicitly allowed to pass through the SG but UFW denies it -- in this case UFW would sort of 'override' the settings in the SG.
As long as you manage both effectively they _could_ coexist without issues.
106
I strongly recommend you to use only "SG(Security Group)" on EC2 even though we can use both "SG" and "UFW. "SG" is a firewall same as "UFW".
When only "SG" allowed "SSH 22" and "UFW" didn't allow "SSH 22" then I logged out ubuntu, I couldn't log in to ubuntu forever, then I terminated ubuntu.
Even though "SG" allowed "SSH 22", I couldn't log in to ubuntu because "UFW" didn't allow "SSH 22". So if either of them doesn't allow "SSH 22", "SSH 22" doesn't work. If both "SG" and "UFW" allow "SSH 22", "SSH 22" works, then we can log in to ubuntu.
I also experimented with "HTTP 80". When only "SG" allowed "HTTP 80" and "UFW" didn't allow "HTTP 80", "HTTP 80" didn't work. When "SG" and "UFW" allowed "HTTP 80", "HTTP 80" worked.
Just remember like "If both allow, it works" and "If only either of them allow, it doesn't work". Actually, using both of them makes complication and some trobles. So again, I really recommend you to use only "SG" on EC2 which is simpler than using both of them.
40
If you love us? You can donate to us via Paypal or buy me a coffee so we can maintain and grow! Thank you!
Donate Us With
