I have hosted my android/web application on a EC2 instance in the private subnet (10.0.1.0) of my VPC. This instance has apache-tomcat installed on it, but does not have a public IP.
I also have a NAT instance in the public subnet (10.0.0.0) of my VPC, with a public IP assigned to the server.
The iptables configuration looks like this:
[ec2-user@ip-10-0-0-21 ~]$ sudo iptables -t nat -L --line-numbers
Chain PREROUTING (policy ACCEPT)
num target prot opt source destination
1 DNAT tcp -- anywhere anywhere tcp dpt:webcache to:10.0.1.11:8080
2 DNAT tcp -- anywhere anywhere tcp dpt:http to:10.0.1.11:8080
3 DNAT tcp -- anywhere anywhere tcp dpt:http to:10.0.1.11:8080
4 DNAT tcp -- anywhere anywhere tcp dpt:https to:10.0.1.11:8080
Chain INPUT (policy ACCEPT)
num target prot opt source destination
Chain OUTPUT (policy ACCEPT)
num target prot opt source destination
Chain POSTROUTING (policy ACCEPT)
num target prot opt source destination
1 MASQUERADE all -- ip-10-0-0-0.ap-southeast-1.compute.internal/16 anywhere
2 MASQUERADE all -- ip-10-0-1-0.ap-southeast-1.compute.internal/24 anywhere
[ec2-user@ip-10-0-0-21 ~]$ sudo iptables -t nat -A POSTROUTING -o eth0 -j SNAT --to XX.XX.XX.XX
Despite these settings, I get a ERR_CONNECTION_TIMED_OUT
error when I try to connect to the public DNS of my NAT server. If my connection request was hitting the apache server, I should have at least gotten a 404.
I have checked the connectivity of my web server (in the private subnet) with the internet via the NAT server. I get valid responses when ping
or wget
google.com.
[ec2-user@ip-10-0-1-11 ~]$ ping google.com
PING google.com (173.194.117.97) 56(84) bytes of data.
64 bytes from sin01s17-in-f1.1e100.net (173.194.117.97): icmp_seq=1 ttl=56 time=3.54 ms
64 bytes from sin01s17-in-f1.1e100.net (173.194.117.97): icmp_seq=2 ttl=56 time=3.57 ms
64 bytes from sin01s17-in-f1.1e100.net (173.194.117.97): icmp_seq=3 ttl=56 time=3.65 ms
64 bytes from sin01s17-in-f1.1e100.net (173.194.117.97): icmp_seq=4 ttl=56 time=3.79 ms
64 bytes from sin01s17-in-f1.1e100.net (173.194.117.97): icmp_seq=5 ttl=56 time=3.61 ms
^C
--- google.com ping statistics ---
5 packets transmitted, 5 received, 0% packet loss, time 4990ms
rtt min/avg/max/mdev = 3.546/3.637/3.799/0.116 ms
[ec2-user@ip-10-0-1-11 ~]$ wget google.com
--2015-09-02 05:22:01-- http://google.com/
Resolving google.com (google.com)... 173.194.117.96, 173.194.117.97, 173.194.117.98, ...
Connecting to google.com (google.com)|173.194.117.96|:80... connected.
HTTP request sent, awaiting response... 200 OK
Length: unspecified [text/html]
Saving to: ‘index.html.1’
index.html.1 [ <=> ] 10.97K --.-KB/s in 0.001s
2015-09-02 05:22:02 (12.7 MB/s) - ‘index.html.1’ saved [11230]
Can someone please point out what is wrong with this setup?
ADDITIONAL INFORMATION: Logs show some garbage requests hitting my web server whenever I ping the public IP of my NAT server. I am totally clueless.
10.0.0.21 - - [02/Sep/2015:06:12:41 +0000] "??]7{]?zɳM?˗?9?G?68???l?xW???D?+?/?,?0?????#?'? ??$?(? " 400 -
10.0.0.21 - - [02/Sep/2015:06:12:41 +0000] "????]f???}???Q?ݹ?U}??????A?#?0D?+?/?,?0?????#?'? ??$?(? " 400 -
10.0.0.21 - - [02/Sep/2015:06:12:42 +0000] "???????{}?hA???????
j?W??P?ߠD?+?/?,?0?????#?'? ??$?(? " 400 -
[ec2-user@ip-10-0-0-21 ~]$ curl -i -H "Accept: application/json" http://10.0.1.11:8080/pocimy/service/welcome HTTP/1.1 200 OK Server: Apache-Coyote/1.1 Content-Type: application/json Transfer-Encoding: chunked Date: Wed, 02 Sep 2015 16:35:01 GMT {"status":"SUCCESS","statuscode":200}[ec2-user@ip-10-0-0-21 ~]$