1

I have two subnets on my VPC, each of them in different AZ. The subnet S1 is public and the subnet S2 is private. I implemented two EC2 instances, each of them on their own subnet.

     / AZ1 ====> S1 (10.0.1.x) =====> EC1 (10.0.1.1)
VPC |
     \ AZ2 ====> S2 (10.0.2.x) =====> EC2 (10.0.2.2)

Well, I created a connection to EC1 using SSH and everything is ok, but if I try to ping to EC2 (10.0.2.2) from EC1 (10.0.1.1), i get this:

ec2-user@ec1 ~# ping 10.0.2.2 
PING 10.0.2.2 (10.0.2.2) 56(84) bytes of data. 
From 10.0.1.1 icmp_seq=1 Destination Host Unreachable 
From 10.0.1.1 icmp_seq=2 Destination Host Unreachable
From 10.0.1.1 icmp_seq=3 Destination Host Unreachable

What would be the problem?

These are the configurations:

The route table for the EC1 computer, is:

ec2-user@ec1 ~# route
Kernel IP routing table
Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
default         ip-10-0-1-1.ec2 0.0.0.0         UG    0      0        0 eth0
10.0.1.0        *               255.255.255.0   U     0      0        0 eth0
10.0.2.0        *               255.255.255.0   U     0      0        0 eth0

The route table for the public subnet S1 is:

Destination  Target           Status Propagated
10.0.0.0/16  local            Active No
0.0.0.0/0    igw-xxxxxx       Active No

The route table for the private subnet S2 is:

Destination  Target           Status Propagated
10.0.0.0/16  local            Active No

The network ACLs are opened for ALL Traffic

EDIT: The security group applied to the computer "EC2"

Inbound
Type         Protocol  Port Range  Source
All traffic  All       All         10.0.0.0/16
2
  • 1
    Do you have any Security Group rules, applied to the "EC2" instance, which might be blocking the ICMP packets for a ping?
    – Castaglia
    May 26, 2016 at 19:13
  • @Castaglia: Yes, it has a group, but it's open for All trafic for computers on 10.0.0.0/16
    – JonDoe297
    May 26, 2016 at 19:27

1 Answer 1

1

I found the problem. The gateway for 10.0.2.x was wrong. I fix it and it's working.

ec2-user@ec1 ~# route
Kernel IP routing table
Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
default         ip-10-0-1-1.ec2 0.0.0.0         UG    0      0        0 eth0
10.0.1.0        *               255.255.255.0   U     0      0        0 eth0
10.0.2.0        ip-10-0-1-1.ec2 255.255.255.0   U     0      0        0 eth0
4
  • 2
    You shouldn't have routes to the other subnets in your instance's route table. The VPC infrastructure takes care of routing. You should only have the default route, which is provided by DHCP. May 26, 2016 at 22:33
  • @Michael-sqlbot That's weird. Without that route, I can't ping to the computers on the network 10.0.2.x. Maybe this is because the "EC1" computer is a Turnkey OpenVPN server and it needs to be configured.
    – JonDoe297
    May 26, 2016 at 22:37
  • 1
    Well, that's anyone's guess, I suppose. I roll my own openvpn machines, so I don't know what they may have done, if anything, contrary to standard practices. Also, I assume 10.0.1.1 and 10.0.2.2 are fake addresses, since those particular last octets are reserved in /24 subnets. May 26, 2016 at 22:50
  • @Michael-sqlbot You're right. They're fake addresses. I selected them to make reading easier.
    – JonDoe297
    May 26, 2016 at 22:55

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .