2

I just finished installing Nginx on my EC2 Ubuntu Server (AWS) and everything looks normal.

I tested it on my browser by accessing my EC2 public IP. I can see Nginx's welcome message.

It's not a big deal, but still bothering me.

My questions are...

  • What is the importance of enabling the UFW?
  • Aren't opening ports 80 & 443 on my security group enough?
  • What's the point of this UFW? Do I really need to enable it?

Because, if I am not wrong, my EC2's UFW is disabled/inactive by default.

Yes, I am still able to visit my nginx homepage (http) on browser. I even deployed my React app on it and set the EC2 instance's inbound connection only to myself.

enter image description here

Improve this question
2
  • Are you accessing the EC2 instance via SSH? If so, you may want to consider using ufw to only allow incoming SSH connections from the IP's that you connect from. See security.stackexchange.com/questions/233785/… for more info.
    – mti2935
    Commented Dec 8, 2021 at 17:37
  • @mti2935 Yes, bro. thank you for the related QnA link that you gave to me. i am currently accessing my EC2 instance via SSH. as for today, i am trying to utilize more on the AWS security group itself. Yes, i've tried to enable the UFW. well, it acts the same as the cloud's security group. i ever read, that many people accidentally couldn't access their instance after they enabled their UFW inappropriately.
    – mr_ternary
    Commented Dec 12, 2021 at 11:10

1 Answer 1

Reset to default
1

You're right, the Security Group of your instance performs the same function as ufw. The Security groups and ufw are categorized as 'firewalls'.

Although ufw has the ability to deny (whereas security groups are limited to just allow), in most cases security group configuration is sufficient for what you wish to achieve. If you really need to a deny configuration, look towards using the NACLs on your VPC subnet. Between the NACLs and Security Groups, you have a very granular control over what traffic can/cannot reach your instance equivalent to that of ufw.

So in practice, you'd either use ufw or Security Groups, it's uncommon to need both.

Improve this answer
2
  • Thank you for the answer @keithRozario , i'll look more into your advice on NALs and subnetting. will try to utilize more on the aws services for instance's security hardening with minimum cost/bills.
    – mr_ternary
    Commented Dec 12, 2021 at 11:18
  • For the sake of "defense in depth" is there any real benefit to having both a host-based firewall and a security group enabled? I've heard that a host-based firewall can prevent worms from propagating in ways that a security group cannot.
    – Prithvi Boinpally
    Commented Mar 28, 2023 at 6:23

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .