My typical cloud server hardening includes blocking ports at the UFW level on the server as well as at the AWS security group level.

I recently learned that Docker overwrites your IPTables. Given that, I had previously blocked a port x with UFW, but also published port x with Docker, which I believe negates my UFW status.

Did my AWS security group settings still block this port x from being exposed to the world?

2 Answers 2


The AWS security groups are independent from your server settings. If you had IPTables open to everything but a AWS security group blocking port 80, port 80 will be blocked.

Therefor, the AWS security groups will still block port x if configured to do so even if the IPTable rules allow the same port.

I recommend you read here about the differences.


AWS Security Group is a Allowed List based host firewall (attached to ENI). Therefore, if you have not added a firewall rule to allow traffic to this specific port (+ from specific IP range) in your AWS Security Group(s) attached to the relevant resource, AWS SG will block that port.

From https://docs.aws.amazon.com/vpc/latest/userguide/VPC_SecurityGroups.html

"Characteristics of security group rules

  • You can specify allow rules, but not deny rules.


  • When you associate multiple security groups with a resource, the rules from each security group are aggregated to form a single set of rules that are used to determine whether to allow access."

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .