Home/ AWS Configuration/ Step 5: Create Security Groups

Step 5: Create Security Groups

Security groups act as virtual firewalls that control inbound and outbound traffic to your EC2 instances. You will create two security groups: one for public servers and one for private servers.

Create the Public-Server Security Group

  1. Navigate to VPC Dashboard and select Security Groups.
  1. Click Create Security Group.
  1. Enter the following settings:
Setting Value
Name tag Public-Server
Group name Public-Server
Description Public Server
VPC My-Company-VPC
  1. Click Create.

Create the Private-Server Security Group

  1. Click Create Security Group again.
  1. Enter the following settings:
Setting Value
Name tag Private-Server
Group name Private-Server
Description Private Server
VPC My-Company-VPC
  1. Click Create.

Configure Inbound Rules for Public-Server

  1. Select Public-Server from the security groups list.
  1. Click the Inbound Rules tab.
  1. Click Edit inbound rules and add the following rules:
Type Protocol Port Range Source Purpose
HTTP TCP 80 0.0.0.0/0 Web traffic
HTTPS TCP 443 0.0.0.0/0 Secure web traffic
RDP TCP 3389 YOUR_PUBLIC_IP/32 Remote Desktop (see warning below)
ALL Traffic ALL ALL 192.168.1.0/24 Local network access
ALL Traffic ALL ALL 10.0.0.0/16 VPC internal traffic

> WARNING: Never open RDP (port 3389) to 0.0.0.0/0. Setting the source to `0.0.0.0/0` allows the entire internet to attempt Remote Desktop connections to your server. Automated bots constantly scan for open RDP ports and will attempt brute-force password attacks within minutes. Always restrict RDP access to only the IP addresses that need it.

Restrict RDP to your IP address

Replace `YOUR_PUBLIC_IP/32` in the RDP rule with your actual public IP address:

  1. Visit https://whatismyip.com from your office or home network to find your public IP.
  2. Enter that IP with a `/32` suffix (for example, `203.0.113.25/32`). The `/32` means only that single IP address is allowed.
  3. If you connect from multiple offices, add a separate RDP rule for each location's public IP.

> Tip: If your ISP assigns a dynamic IP address that changes periodically, you will need to update the security group rule when your IP changes. For a more flexible approach, consider using AWS Systems Manager Session Manager to connect to your instances without opening RDP to the internet at all. Session Manager provides browser-based or CLI access and requires no inbound ports.

  1. Click Save rules.

Configure Inbound Rules for Private-Server

  1. Select Private-Server from the security groups list.
  1. Click the Inbound Rules tab.
  1. Click Edit inbound rules and add the following rules:
Type Protocol Port Range Source Purpose
ALL Traffic ALL ALL 10.0.0.0/16 VPC internal traffic
ALL Traffic ALL ALL 192.168.1.0/24 Local network access
  1. Click Save rules.

Important Note

The examples above assume your local network uses a LAN subnet of 192.168.1.0/24. You must change this value to match your actual local network configuration.

To find your local subnet:

  1. Open Command Prompt on a computer in your local network.
  2. Type `ipconfig` and press Enter.
  3. Note your IPv4 address and subnet mask.

Related Topics

← Back to Index