An EC2 instance is running Amazon Linux in a public subnet in a VPC.
Here are the outbound rules for its security group:
ALLOW TCP on port 80 to 0.0.0.0/0
ALLOW TCP on port 443 to 0.0.0.0/0
ALLOW ICMP to 0.0.0.0/0
First I SSH into the instance. Then, I attempt to make a simple request to the outside internet:
[ec2-user@nat1 ~]$ curl -v wikipedia.org/
* Trying 208.80.154.224...
* Trying 2620:0:861:ed1a::1...
* Immediate connect fail for 2620:0:861:ed1a::1: Network is unreachable
Note that DNS is being resolved by my own AWS Route 53 dns server within the VPC, so that does not prove outside connectivity.
I see Trying 208.80.154.224...
followed by no details about failure- any way to get more info right there?
The next step looks like a malformed attempt to translate that address to IPv6. Is this a clue? Or just the automatic recourse when IPv4 fails?
The ultimate error "Network is unreachable" seems likely to be referring to overall failure of the IPv6 network- which is fine for my purposes now. So that still leaves me looking for more details about the first failure to try the correct IPv4 address.
And now here's the entry in the subnet flow log for the network interface of this EC2 instance, filtered to only the IP address 208.80.154.224
. All the lines I see end in ACCEPT OK
like this:
Event Data
2 027141088039 eni-66c1933c 10.0.17.220 208.80.154.224 60761 80 6 2 120 1436199193 1436199253 ACCEPT OK