---
title: "Control peering traffic with security groups"
description: "Attach security groups to a VPC's gateway in MyAccount to decide which traffic crosses its peering connections, and open it fully while you debug."
content_type: "how-to"
product: "vpc"
platform: "MyAccount"
url: "/myaccount/vpc/how-to/control-peering-traffic-with-security-groups/"
topic: ["peering"]
relationships: {"requires":["/myaccount/vpc/how-to/peer-two-vpcs/"]}
---

# Control peering traffic with security groups

Traffic between two peered VPCs passes through each VPC's gateway, and the security groups on the
gateway decide what gets through. When you create a peering connection, E2E puts the group the
connection needs on both gateways, so a new connection works with no setup. Attach your own groups
when you want to narrow it, for example to let only your application's port cross from one network
to the other.

The resource at the other end still applies its own security groups, so they need to allow traffic
from the first VPC's range as well; see
[Add or edit rules](/myaccount/security-group/how-to/add-or-edit-rules/).

## Before you begin

- A VPC with a peering connection. See [Peer two VPCs](/myaccount/vpc/how-to/peer-two-vpcs/).
- The security group you want on the gateway, with rules for the traffic you mean to allow. To make
  one, see [Create a security group](/myaccount/security-group/how-to/create-a-security-group/). Its
  rules need to keep allowing traffic from the other VPC's gateway. That gateway's public IP is
  under **Network Gateway** on the other VPC's **VPC Details** tab.

## Attach a security group to the gateway

1. Open **Network > VPC**, select the VPC, and open its **Security Groups** tab. It lists the groups
   on the VPC's gateway, each with its description.
2. Click **Attach Security Group**, choose one or more groups from the list, and click **Attach**.

A message confirms the change, and the groups join the list. Attaching your own group takes E2E's
default group off the gateway, so from now on your groups' rules decide what crosses. Do the same on
the other VPC if you want the rules on both sides.

To change a group's rules later, click the edit icon beside it. The group opens in **Manage Security
Groups**; see [Add or edit rules](/myaccount/security-group/how-to/add-or-edit-rules/).

## Open all traffic while you find a problem

If the connection stops passing traffic after you change the gateway's groups, click **Allow All
Traffic** on the **Security Groups** tab. It adds a group that lets all traffic in and out of the
gateway, so you can check whether a rule is the cause, and it stays attached until you detach it.
Detach it as soon as you have fixed your rules.

## Detach a security group

Next to the group, click **Detach**, then **Confirm**. The gateway always keeps at least one group,
so detaching the last one shows "At least one security group is mandatory, attach another to detach
this one." Attach its replacement first.

Check the result from a resource on one side: the traffic your groups allow still reaches the other
VPC, and the rest does not.
[Troubleshooting VPC](/myaccount/vpc/troubleshooting/vpc/#peered-resources-cannot-reach-each-other)
lists what else to check when traffic stops that should get through.