Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I'm trying to create a NAT instance for my VPC to allow instances on private subnets connect to the internet (most importantly, S3). I tried following the instructions here: http://docs.amazonwebservices.com/AmazonVPC/2011-07-15/UserGuide/index.html?VPC_NAT_Instance.html . Unfortunately, the instances in the private subnet (call it 10.10.2.0/24) cannot reach the internet.

I have done the following:

  1. Create a NAT instance (Amazon's ami-vpc-nat-1.0.0-beta.i386-ebs (ami-d8699bb1)) in public subnet (call it 10.10.1.0/24).
  2. Changed "Source / Dest Check" to disabled.
  3. Created a new entry in the default routing table (which is used by 10.10.2.0/24) and had it point to the ID of the newly created instance.
  4. Associated an Elastic IP address with the NAT instance.
  5. Allowed all outbound traffic on the security group of the NAT instance.
  6. Ensured that all traffic could pass between the two subnets.

I've tried also doing this with an existing instance using iptables, but had no luck. And I have verified that sys.net.ipv4.ip_forward is 1, just in case anyone was wondering. And I still have no internet connectivity from the instances on 10.10.2.0/24. Does anyone have any suggestions?

share|improve this question
add comment

2 Answers 2

Just to be clear, you have two routing tables, one NAT instance and one Internet Gateway right? The default route (0.0.0.0/0) for the routing table used by the public subnet should be to the Internet Gateway (igw) and the default route in the routing table used by private subnets should be the NAT instance. AWS sometimes set those for you automatically when you use their wizard, but I assume you are setting it up manually since you are setting up the NAT instance manually.

share|improve this answer
add comment

Create a NAT instance (Amazon's ami-vpc-nat-1.0.0-beta.i386-ebs (ami-d8699bb1)) in public subnet (call it 10.10.1.0/24).

also you can find it from the static VPC, to ensure to connecting with the public cloud, with the 10.10.1.3/24

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.