# Differences Between Security Groups and Firewalls

You can configure security groups and firewall to increase the security of ECSs in your VPC.

- Security groups operate at the ECS level.
- Firewalls operate at the subnet level.

For details, see Figure 1.

Figure 1 Security groups and firewalls

Table 1 describes the differences between security groups and firewalls.

Table 1 Differences between security groups and firewalls
Category | Security Group | Firewall
--- | --- | ---
Targets | Operates at the ECS level. | Operates at the subnet level.
Rules | Supports both Allow and Deny rules. | Supports both Allow and Deny rules.
Priority | If there are conflicting rules, they are combined and applied together. | If rules conflict, the rule with the highest priority takes effect.

Usage

Automatically applies to ECSs in the security group that is selected during ECS creation. You must select a security group when creating ECSs.

Applies to all ECSs in the subnets associated with the firewall. Selecting a firewall is not allowed during subnet creation. You must create a firewall, associate subnets with it, add inbound and outbound rules, and enable firewall. The firewall then takes effect for the associated subnets and ECSs in the subnets.

Packets | Only packet filtering based on the 3-tuple (protocol, port, and peer IP address) is supported. | Only packet filtering based on the 5-tuple (protocol, source port, destination port, source IP address, and destination IP address) is supported.

Parent topic: Security