A Windows Server running on EC2 is protected by two independent firewall layers — the AWS security group at the network level, and Windows Defender Firewall inside the instance itself — and traffic needs to pass both to succeed.
Common Symptoms
- The security group allows the port, but the connection still fails
- RDP works from inside the VPC but not from the internet
- A specific application on the instance can’t be reached even though RDP works
Possible Causes
- Security group correctly allows the port, but Windows Defender Firewall on the instance blocks it
- A newly installed application didn’t create its own Windows Firewall rule
- Confusion about which layer is actually responsible for a given block
Before You Begin
Think of it as two locked doors in sequence: AWS security group is the outer door (network-level), Windows Firewall is the inner door (OS-level) — both need to be unlocked for traffic to get through.
Method 1 — Confirm the security group rule
Check the AWS-level rule
Confirm an inbound rule exists on the instance’s security group for the specific port and source IP range needed.
Method 2 — Confirm the Windows Firewall rule
Check inside the instance
Once connected (e.g. via RDP), open Windows Defender Firewall with Advanced Security and confirm an inbound rule exists for the same port.
Method 3 — Test each layer independently
Isolate which layer is blocking
Temporarily open the security group fully (for testing only, then revert) — if the connection still fails, the block is on the Windows Firewall side, not AWS.
Never leave a security group open to 0.0.0.0/0 on a sensitive port like RDP (3389) — restrict it to a specific known IP range and revert any test changes immediately after diagnosing the issue.
Frequently Asked Questions
If I open the security group, does that mean Windows Firewall is bypassed?
No — the two layers are independent and both need to permit the traffic. Opening the security group only removes the network-level restriction; the instance’s own OS firewall is still evaluated separately.
Conclusion
Treating the security group and the instance’s own firewall as two separate checkpoints — and testing each independently — resolves most “it should be open but still doesn’t work” cases on AWS.
Related Articles
