Best Practices for Securing AWS Instances Behind IPFire Firewall

[anderson_5 (Anderson Linda)]

Hey community!!!

I have a number of AWS EC2 instances that I need to keep safe while still being able to access them for my apps.

I’m having trouble with things that happen to a lot of people, and I would love to hear your best tips:

How to set up firewalls (on-premises or in the cloud) so that AWS instances are safe without losing connectivity.

When hosting apps on EC2, which ports and services should be open and which should be closed?

The best ways to keep an eye on and stop attacks like DoS, brute-force attempts, or strange traffic.

For AWS environments, here are some good IDS/IPS rule sets, logging, and alerting strategies.

I’m looking for useful tips from anyone who has successfully protected AWS workloads. What mistakes should I avoid, and what worked best for you?

Thanks in advance!

[ms (Michael Tremer)]

Hello,

@anderson_5

How to set up firewalls (on-premises or in the cloud) so that AWS instances are safe without losing connectivity.

there is a detailed guide available on our wiki:

Amazon Web Services

It explains how to set up the VPC and then deploy IPFire in it.

@anderson_5

When hosting apps on EC2, which ports and services should be open and which should be closed?

This entirely depends on what kind of application you are hosting.

@anderson_5

The best ways to keep an eye on and stop attacks like DoS, brute-force attempts, or strange traffic.

For AWS environments, here are some good IDS/IPS rule sets, logging, and alerting strategies.

There is nothing special about AWS here. The rules that apply to any data center deployment also apply to AWS. There is also some guidance on the wiki.

-Michael