A VPC, with security groups, can be much easier, depending on how your instances are managed. You’re sure that all the indtances have the same rules and that the rules are always updated, even in if you use auto-scaling.

If you use some provisioning tool you can have the same thing with IPtables. But why are you on AWS if you don’t want to used the features Amazon provides?