I'm currently working on setting up a QA environment on EC2 along side our production environment. All of the instances are within a VPC setup, with the following subnets: - Production - QA

I have a EC2 instance running as a gateway machine that is already has 2 NICs, which seems to be the limit (One NIC for the external IP, the other for internal). My initial plan was to just add another NIC in the subnet, but that seems to be impossible.

So, my next plan was to add the new IP to the existing internal NIC, which results in this config:

eth1      Link encap:Ethernet  HWaddr 06:84:b1:68:6a:72
          inet addr:  Bcast:  Mask:   

eth1:0    Link encap:Ethernet  HWaddr 06:84:b1:68:6a:72
          inet addr:  Bcast:  Mask:

And then insuring the virtual NIC is in the correct security groups. The routing table appears correct:       *        U     203    0        0 eth1       *        U     0      0        0 eth1

I then set up shorewall for the new address, and restarted it:

-       eth1  , logmartians

#ZONE   HOST(S)                                 OPTIONS
loc     eth1:
qa      eth1:

#SOURCE DEST    POLICY          LOG     LIMIT:          CONNLIMIT:
#                               LEVEL   BURST           MASK
qa      net     ACCEPT
$FW     qa      ACCEPT

The generated iptables rules appear sane, however, I do not have connectivity to the subnet (either pinging or nmap)

Anyone have experience with a setup like this in EC2, that can hopefully point out something obvious I'm missing?

  • From where do you can't ping Yes I did the multi IP shorewall setup on a single host.
    – Chakri
    Jun 1, 2012 at 17:35

3 Answers 3


I can't comment, but I want to correct the other answers. At least now, a "single EC2 instance can now be attached to two ENIs, each one on a distinct subnet. The ENI (not the instance) is now associated with a subnet."

Source: https://aws.amazon.com/blogs/aws/new-elastic-network-interfaces-in-the-virtual-private-cloud/#:~:text=A%20single%20EC2%20instance%20can,They%20are%20also%20truly%20elastic.


I dont think you can just alias an Elastic Network Interface (ENI) into another subnet. Have you tried adding another private IP to it through the AWS console (right click the instance and click manage network interfaces, or something like that)?

Also, different instances have limits on the number of interfaces they can have. Heres a table: http://docs.aws.amazon.com/AWSEC2/latest/UserGuide/using-eni.html#AvailableIpPerENI


Your EC2 is created in subnet. So your EC2 can have ENI only from this subnet. This is placement rule. Your EC2 does not have visibility to a subnet it is not part of.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .