1

I have hosted my android/web application on a EC2 instance in the private subnet (10.0.1.0) of my VPC. This instance has apache-tomcat installed on it, but does not have a public IP.

I also have a NAT instance in the public subnet (10.0.0.0) of my VPC, with a public IP assigned to the server.

The iptables configuration looks like this:

[ec2-user@ip-10-0-0-21 ~]$ sudo iptables -t nat -L --line-numbers
Chain PREROUTING (policy ACCEPT)
num  target     prot opt source               destination
1    DNAT       tcp  --  anywhere             anywhere             tcp dpt:webcache to:10.0.1.11:8080
2    DNAT       tcp  --  anywhere             anywhere             tcp dpt:http to:10.0.1.11:8080
3    DNAT       tcp  --  anywhere             anywhere             tcp dpt:http to:10.0.1.11:8080
4    DNAT       tcp  --  anywhere             anywhere             tcp dpt:https to:10.0.1.11:8080

Chain INPUT (policy ACCEPT)
num  target     prot opt source               destination

Chain OUTPUT (policy ACCEPT)
num  target     prot opt source               destination

Chain POSTROUTING (policy ACCEPT)
num  target     prot opt source               destination
1    MASQUERADE  all  --  ip-10-0-0-0.ap-southeast-1.compute.internal/16  anywhere
2    MASQUERADE  all  --  ip-10-0-1-0.ap-southeast-1.compute.internal/24  anywhere
[ec2-user@ip-10-0-0-21 ~]$ sudo iptables -t nat -A POSTROUTING -o eth0 -j SNAT --to XX.XX.XX.XX

Despite these settings, I get a ERR_CONNECTION_TIMED_OUT error when I try to connect to the public DNS of my NAT server. If my connection request was hitting the apache server, I should have at least gotten a 404.

I have checked the connectivity of my web server (in the private subnet) with the internet via the NAT server. I get valid responses when ping or wget google.com.

[ec2-user@ip-10-0-1-11 ~]$ ping google.com
PING google.com (173.194.117.97) 56(84) bytes of data.
64 bytes from sin01s17-in-f1.1e100.net (173.194.117.97): icmp_seq=1 ttl=56 time=3.54 ms
64 bytes from sin01s17-in-f1.1e100.net (173.194.117.97): icmp_seq=2 ttl=56 time=3.57 ms
64 bytes from sin01s17-in-f1.1e100.net (173.194.117.97): icmp_seq=3 ttl=56 time=3.65 ms
64 bytes from sin01s17-in-f1.1e100.net (173.194.117.97): icmp_seq=4 ttl=56 time=3.79 ms
64 bytes from sin01s17-in-f1.1e100.net (173.194.117.97): icmp_seq=5 ttl=56 time=3.61 ms
^C
--- google.com ping statistics ---
5 packets transmitted, 5 received, 0% packet loss, time 4990ms
rtt min/avg/max/mdev = 3.546/3.637/3.799/0.116 ms
[ec2-user@ip-10-0-1-11 ~]$ wget google.com
--2015-09-02 05:22:01--  http://google.com/
Resolving google.com (google.com)... 173.194.117.96, 173.194.117.97, 173.194.117.98, ...
Connecting to google.com (google.com)|173.194.117.96|:80... connected.
HTTP request sent, awaiting response... 200 OK
Length: unspecified [text/html]
Saving to: ‘index.html.1’

index.html.1                                [ <=>                                                                              ]  10.97K  --.-KB/s   in 0.001s

2015-09-02 05:22:02 (12.7 MB/s) - ‘index.html.1’ saved [11230]

Can someone please point out what is wrong with this setup?

ADDITIONAL INFORMATION: Logs show some garbage requests hitting my web server whenever I ping the public IP of my NAT server. I am totally clueless.

10.0.0.21 - - [02/Sep/2015:06:12:41 +0000] "??]7{]?zɳM?˗?9?G?68???l?xW???D?+?/?,?0?????#?'? ??$?(? " 400 -
10.0.0.21 - - [02/Sep/2015:06:12:41 +0000] "????]f???}???Q?ݹ?U}??????A?#?0D?+?/?,?0?????#?'? ??$?(? " 400 -
10.0.0.21 - - [02/Sep/2015:06:12:42 +0000] "???????{}?hA???????
                                                               j?W??P?ߠD?+?/?,?0?????#?'? ??$?(? " 400 -
5
  • security groups on the tomcat instance blocking? Can you connect to port 8080 from the nat instance? Why not use a ELB? That's what they are for
    – Mike
    Sep 2, 2015 at 5:59
  • localhost:8080 gives a successful response.
    – AP-
    Sep 2, 2015 at 6:20
  • 1
    from the NAT instance
    – Mike
    Sep 2, 2015 at 7:29
  • Got a success when I pinged my application from the NAT server. [ec2-user@ip-10-0-0-21 ~]$ curl -i -H "Accept: application/json" http://10.0.1.11:8080/pocimy/service/welcome HTTP/1.1 200 OK Server: Apache-Coyote/1.1 Content-Type: application/json Transfer-Encoding: chunked Date: Wed, 02 Sep 2015 16:35:01 GMT {"status":"SUCCESS","statuscode":200}[ec2-user@ip-10-0-0-21 ~]$
    – AP-
    Sep 2, 2015 at 16:35
  • that log makes it seem like you are passing ssl back to a non-ssl server
    – Mike
    Sep 2, 2015 at 19:39

0

You must log in to answer this question.