0

I found this question (very helpful) Cannot ping AWS EC2 instance So I'm setting up my EC2 instance so I can ping it.

But I don't want to allow ping requests from anyone on the Internet. I want to limit the source to my current location's subnet.

When I setup ssh, I also limited who can ssh to my EC2 instance but don't recall how I set it up.

Searching for a solution

I found this: https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/security-group-rules-reference.html#sg-rules-ping which was helpful to only allow ICMP Echo Requests (protocol 1).

Later I found this command which helped me find the one I created earlier.

aws ec2 describe-security-groups
{
    "SecurityGroups": [
        {
            "Description": "launch-wizard-2 created 2021-07-16T14:45:19.317-04:00",
            "GroupName": "launch-wizard-2",
            "IpPermissions": [
                {
                    "FromPort": 80,
                    "IpProtocol": "tcp",
                    "IpRanges": [
                        {
                            "CidrIp": "192.168.1.0/24" // NOTE THIS IS NOT REAL
                        }
                    ],
                    "Ipv6Ranges": [],
                    "PrefixListIds": [],
                    "ToPort": 80,
                    "UserIdGroupPairs": []
                },

So now I realize the one that was previously created is only setup for TCP (not ICMP) so it won't work for me.

Still searching for how specify a source CIDR block to limit who can ping my EC2 instance. For the sake of discussion, lets say my CIDR block was 123.321/16 I'm trying to figure out how to enter that when creating the inbound rule.

John Rotenstein
  • 241,921
  • 22
  • 380
  • 470
PatS
  • 8,833
  • 12
  • 57
  • 100
  • Look at the instance in the EC2 console. Take a look at the Security Groups associated with the instance. Add an Inbound rule for ICMP from your IP address. – John Rotenstein Sep 23 '21 at 22:17
  • Does SO have any rules for fake IP addresses (used for examples)? I picked 123.321 because it's not a valid IP but that just makes the example confusing. – PatS Sep 24 '21 at 00:49

1 Answers1

1

Well, 123.321 cannot exist as a CIDR as the number 321 is too big. However, if it could, your inbound security group rule would need to look like the following:

enter image description here

You could also specify 123.321.123.12/32 for the exact IP of whatever is trying to ping it.

David Webster
  • 2,208
  • 1
  • 16
  • 27
  • I tried that and it wouldn't take/stay. I'll try it again. Thanks! – PatS Sep 24 '21 at 00:39
  • When I tried it again, I realized that the UI did accept my entry (it was a valid CIDR). I realized that I was just confused by the user interface. – PatS Oct 17 '21 at 19:49