-1

An EC2 instance is running Amazon Linux in a public subnet in a VPC.

Here are the outbound rules for its security group:

ALLOW TCP on port 80 to 0.0.0.0/0
ALLOW TCP on port 443 to 0.0.0.0/0
ALLOW ICMP to 0.0.0.0/0

First I SSH into the instance. Then, I attempt to make a simple request to the outside internet:

[ec2-user@nat1 ~]$ curl -v wikipedia.org/
*   Trying 208.80.154.224...
*   Trying 2620:0:861:ed1a::1...
* Immediate connect fail for 2620:0:861:ed1a::1: Network is unreachable

Note that DNS is being resolved by my own AWS Route 53 dns server within the VPC, so that does not prove outside connectivity.

I see Trying 208.80.154.224... followed by no details about failure- any way to get more info right there?

The next step looks like a malformed attempt to translate that address to IPv6. Is this a clue? Or just the automatic recourse when IPv4 fails?

The ultimate error "Network is unreachable" seems likely to be referring to overall failure of the IPv6 network- which is fine for my purposes now. So that still leaves me looking for more details about the first failure to try the correct IPv4 address.

And now here's the entry in the subnet flow log for the network interface of this EC2 instance, filtered to only the IP address 208.80.154.224. All the lines I see end in ACCEPT OK like this:

Event Data
2 027141088039 eni-66c1933c 10.0.17.220 208.80.154.224 60761 80 6 2 120 1436199193 1436199253 ACCEPT OK
1
  • 1
    Curious why the community believes this question doesn't belong here. Feb 29, 2020 at 20:11

1 Answer 1

3

The EC2 Instance in question had no public IPv4 address ergo could not participate in The Internet.

Simply assign a public IP address to the instance, and:

[ec2-user@nat1 ~]$ curl -v wikipedia.org/
*   Trying 208.80.154.224...
* Connected to wikipedia.org (208.80.154.224) port 80 (#0)

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .