I'm currently working on setting up a QA environment on EC2 along side our production environment. All of the instances are within a VPC setup, with the following subnets:
10.0.83.0/24 - Production
10.0.81.0/24 - QA
I have a EC2 instance running as a gateway machine that is already has 2 NICs, which seems to be the limit (One NIC for the external IP, the other for internal). My initial plan was to just add another NIC in the 10.0.81.0/24 subnet, but that seems to be impossible.
So, my next plan was to add the new IP to the existing internal NIC, which results in this config:
eth1 Link encap:Ethernet HWaddr 06:84:b1:68:6a:72
inet addr:10.0.83.10 Bcast:10.0.83.255 Mask:255.255.255.0
eth1:0 Link encap:Ethernet HWaddr 06:84:b1:68:6a:72
inet addr:10.0.81.10 Bcast:10.0.81.255 Mask:255.255.255.0
And then insuring the virtual NIC is in the correct security groups. The routing table appears correct:
10.0.83.0 * 255.255.255.0 U 203 0 0 eth1
10.0.81.0 * 255.255.255.0 U 0 0 0 eth1
I then set up shorewall for the new address, and restarted it:
/etc/shorewall/interfaces:
#ZONE INTERFACE BROADCAST OPTIONS
....
- eth1 10.0.83.255,10.0.81.255 logmartians
....
/etc/shorewall/hosts
#ZONE HOST(S) OPTIONS
loc eth1:10.0.83.0/24
qa eth1:10.0.81.0/24
/etc/shorewall/policy
#SOURCE DEST POLICY LOG LIMIT: CONNLIMIT:
# LEVEL BURST MASK
qa net ACCEPT
$FW qa ACCEPT
The generated iptables rules appear sane, however, I do not have connectivity to the 10.0.81.0/24 subnet (either pinging or nmap)
Anyone have experience with a setup like this in EC2, that can hopefully point out something obvious I'm missing?
