1

The official AWS docs state:

If you are connecting through an ISP or from behind your firewall without a static IP address, you need to find out the range of IP addresses used by client computers.

How can this even work? How does AWS know which address my router is giving me on my internal network?

I actually tried it out, by denying all access to an instance and then explicitly whitelisting:

  • My public IP: This really does not give me access
  • My private IP: Gets me access

Isn't this super weird? Couldn't anybody configure their home router to give them the same private IP and then be able to connect to my "protected" AWS instance?

I assumed that AWS wouldn't even see my private IP because of NAT?

3

I read your linked documents and it seems to me pretty clear AWS is speaking of public IP addresses, as you imagine. I can't comment on your tests beyond saying they go against my experience and your expectation. I'd suggest redoing the tests.

The exact phrase is about the range of public IP addresses your ISP is using if they are giving you a dynamic public IP address.

Amazon document you linked, with my emphasis:

Decide who requires access to your instance; for example, a single host or a specific network that you trust such as your local computer's public IPv4 address. The security group editor in the Amazon EC2 console can automatically detect the public IPv4 address of your local computer for you. Alternatively, you can use the search phrase "what is my IP address" in an internet browser, or use the following service: Check IP. If you are connecting through an ISP or from behind your firewall without a static IP address, you need to find out the range of IP addresses used by client computers.

  • yeah, that's how I would've understood it as well. Thing is, I actually tested it out and I don't have access to my instance if I don't whitelist my internal, private IP! – DeX3 Feb 15 at 13:34
0

You can't be right about that. I read the documentation that you have provided and it clearly states:

"The security group editor in the Amazon EC2 console can automatically detect the public IPv4 address of your local computer for you. Alternatively, you can use the search phrase "what is my IP address" in an internet browser, or use the following service: Check IP."

Which is telling you how to find the public IP for the range of client computers behind your firewall.

However, you may well be connected to your Amazon Cloud via IPSEC VPN, in which case it WOULD know the private IP address of your computer. Use the traceroute command to see how you are connecting the EC2.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.