Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm just getting into VPC, trying to understand how everything works. So far the biggest hurdle I've run into is that any time I add a second Elastic NIC to a machine, that second IP is not accessible by any others in the VPC. Here's what I did

  • Launched Canonical provided AMI for Ubuntu 12.10 x64 EBS.
  • During launch I configured it for two network interfaces (same subnet)
  • Once the machine was up, I added the following to /etc/network/interfaces :

auto eth1

iface eth1 inet dhcp

  • ifup eth1
  • Run ifconfig, verify the second address is up.

On my primary (internet accessible) instance:

  • ping (IP for new instance eth0) - Works
  • ping (IP for new instance eth1) - FAILS

There are no ACL's that prevent ping, as it works with eth0. There is no firewall setup on the machine. I've tried 4 different instances across several SGs and AZs with multiple interfaces, all with the same result.

I've been bashing my head against the wall for longer than I care to admit on this. I cannot figure out where the error is on this.

share|improve this question
What's your route table look like before and after you add the ENI? – jamieb Jan 26 '13 at 3:17
You ever figure this out? I'm having the same problem. – user160576 Feb 18 '13 at 20:18
@user160576 Nope. I gave up and just did everything on eth0. Since eth0 actually is an internal IP, you can use that as both your internal and your external network interface for routing. I was thinking more along the classic lines of eth0 = ethernet cable to DSL model and eth1 = ethernet cable to local switch. That's not really the case here. – Jon Jul 28 '13 at 16:56
Why are both ENIs in the same subnet? That doesnt get you anything – Alex Oct 2 '13 at 14:16

The routing table by default will only route traffic to eth0. Even though ubuntu detects the other ENI, you still have to route traffic to it.

You'll have to do some advanced routing:

1) Enabling access to 2nd ENI immediately and temporarily.


# this will show your route table, i'll assume you have eth0 and eth1
# and your default is for eth0 to point to the gateway
# for this example lets assume the following:
# eth0 = 
# eth1 =
# gateway =
ip route show ;

# first step is to create a routing table for your new device
cat /etc/iproute2/rt_tables ;
echo 2 eth1_rt >> /etc/iproute2/rt_tables ;

# next add the eth1_rt route table, so by default it will also point to the gateway
ip route add default via dev eth1 table eth1_rt ;

# next take a look at your ip rules
# i'll assume the defaults here, and things flows to default with priority 32767
ip rule;

# let's add a rule, if we see traffic from eth1's IP address,
# use its new routing table we setup, and give it higher priority than default
ip rule add from lookup eth1_rt prio 1000 ;

# done! now check your traffic from both IPs, they should both work.

2) Enabling access to 2nd ENI on reboot but persistently.


Additionally, if you want this change to persist, you can make all these changes in the interface file and just restart the network service or reboot for it to take effect.

# NOTE: add the eth1_rt routing table to /etc/iproute2/rt_tables as show in previous section

# original config to make dchp, I add mine to /etc/network/interfaces.d/eth1.cfg
auto eth1
iface eth1 inet dchp
    # your extra rules for eth1
    up ip route add default via dev eth1 table eth1_rt
    up ip rule add from lookup eth1_rt prio 1000

For this to take full effect, reboot the system.

NOTE: I tried /etc/init.d/networking restart; but it didn't pick up the route/rule changes, not sure why, so I had reboot. In the event you want to make it immediate and persistent, do both methods.

share|improve this answer

Here is how I do it. I use static IP. Initially I use dhcp to get 2 items. The IP address and the netmask. Here is the step by step instruction:

  • boot the instance
  • sudo cp /etc/network/interfaces.d/eth0.cfg /etc/network/interfaces.d/eth1.cfg

  • sudo sed -i "s/eth0/eth1/g" /etc/network/interfaces.d/eth1.cfg

  • sudo ifdown eth1

  • sudo ifup eth1

  • sudo ifconfig eth1 | tee /tmp/ifconfig-eth1-output.txt

  • sudo ifdown eth1

  • sudo rm -f /etc/network/interfaces.d/eth1.cfg

  • ETH0_IP=$(cat /tmp/ifconfig-eth1-output.txt | grep "inet addr:" | cut -f 2 -d':' | cut -f 1 -d' ')

  • ETH0_NETMASK=$(cat /tmp/ifconfig-eth1-output.txt| grep "inet addr:" | cut -f 4 -d':')

  • ETH0_GATEWAY=$(echo ${ETH0_IP} | sed "s/[0-9]*$/1/g")

  • echo "auto eth1" > /tmp/eth1.cfg

  • echo "iface eth1 inet static" >> /tmp/eth1.cfg

  • echo "address ${ETH0_IP}" >> /tmp/eth1.cfg

  • echo "netmask ${ETH0_NETMASK}" >> /tmp/eth1.cfg

  • echo "up ip route add default via ${ETH0_GATEWAY} dev eth1 table 1 metric 10001" >> /tmp/eth1.cfg

  • echo "up ip rule add from ${ETH0_IP}/32 table 1 priority 10001" >> /tmp/eth1.cfg

  • echo "up ip route flush cache" >> /tmp/eth1.cfg

  • sudo cp -f /tmp/eth1.cfg /etc/network/interfaces.d/

  • sudo ifup eth1

that should do it, run these to check.

these would take immediate effect and will persist through reboots.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.