title: Cant connect to internet facing ELB from instance in VPC
body: <p>I have a V2 ELB that is internet facing.  It routes requests to instances in VPC just fine when I connect to it from my laptop.  However when I try to connect to it from another instance inside the same VPC the Security Group firewall rules block the connection.</p>
  
  <p>The only way I can get the instances in VPC to connec to the ELB is by opening the https port (443) to the world.</p>
  
  <p>What am I doing wrong?</p>
  
  <p>The ELB (<a href="https://elb.domain.com" rel="noreferrer">https://elb.domain.com</a>) has the following attrs:</p>
  
  <ul>
  <li>Internet facing, V2 (not classic ELB)</li>
  <li>VPC: vpc-aaa</li>
  <li>AZs: subnet-a,subnet-b</li>
  <li>Listeners: 443 -> 8080 instance port</li>
  <li>source security group: my-vpc-elb, with inbound rules:
  
  <ul>
  <li>443, source: 1.2.3.170/32 (my laptop IP)</li>
  <li>443, source: sg-a (the name of the sg that my vpc instance, that cant connect, is in)</li>
  <li>443, source <code>&lt;CIDR of vpc-aaa, 1.2.0.0/16&gt;</code></li>
  </ul></li>
  </ul>
  
  <p>From my laptop I can put in <a href="https://elb.domain.com" rel="noreferrer">https://elb.domain.com</a> and things work fine.</p>
  
  <p>I now have another instance with the following attrs that can NOT connect to <a href="https://elb.domain.com" rel="noreferrer">https://elb.domain.com</a>:</p>
  
  <ul>
  <li>Subnet ID: subnet-a</li>
  <li>Security Group: sg-a</li>
  </ul>
  
  <p>Why does the ELB Security group rule of <code>443, source: sg-a</code> not allow the connection? Why does it only work when I allow inbound "All traffic" on 443 in the ELB security group?</p>