In aws ec2, users can set up **security groups** which works like a firewall, usually, firewall work behind a gateway/nat server, however, I found that firewall in EC2 works in the LAN, too.

For example, users have too instances, `A: 10.108.33.13/26`, `B: 10.108.33.18/26`, according to the `ip` and `netmask`, they are in the same LAN, however, if I put those instances in different **security groups**(and the rules block visit from different sgs), the firewall works on them. 

My questions is, I think firewall works only in Layer3/4, on which ip and port were. In the LAN, traffic between hosts goes throught Layer2(by MAC address). How could it be possible to implement such firewall in a LAN?

P.S. I checked the iptables on each host and I am sure it's stopped.