I've read on many sites that the answer to attaching multiple public IP addresses to an EC2 instance (for SSL, redirection, whatever purposes) is to create multiple private IP addresses, attach elastic IP addresses to aforementioned private addresses, making sure that the private IP address ENIs are attached to the EC2 instance, and finally ensuring that a corresponding network interface is created and configured on the OS running on the EC2 instance.

So if I'm correct in understanding, as long as the private IP address is linked to an EC2 instance and subsequently configured on it, an elastic IP will resolve to that private IP address, thus to that machine (provided the network interface is correctly set up on the machine and corresponds to the attached ENI).

I cannot for the life of me, get this to work. I have a new ENI, with a new private IP, which is attached to my instance. I have an elastic (public) IP linked up to the private IP on that ENI.

I've created a new network interface on my Debian 7 machine (eth1, which was assigned by AWS when I created the second ENI) using the private IP, as follows:

auto lo
iface lo inet loopback
auto eth0 eth1
iface eth0 inet dhcp
iface eth1 inet static
  address xxx.xxx.xxx.xxx
  netmask xxx.xxx.xxx.xxx

EDIT: I've also tried

auto lo
iface lo inet loopback
auto eth0 eth1
iface eth0 inet dhcp
iface eth1 inet dhcp

I've verified that the private IP address and second interface are correctly installed through an "ifconfig" command, which shows both eth0 and eth1. I can ping the private IP address. I have the corresponding public IP set in DNS (which is supposed to resolve to the private IP).

To make a long story short, I cannot ping the A name that maps to my second public IP, or the IP itself. They all time out. My firewall permits ICMP requests and my AWS security group allows all ports/hosts inbound and outbound.

What on earth am I missing? I've been stuck on this for nearly three days now. I feel like I'm close, but it must be something obvious.

ping dev2.my.tld
PING dev2.my.tld (xxx.xxx.xxx.xxx) 56(84) bytes of data.
--- dev2.my.tld ping statistics ---
4 packets transmitted, 0 received, 100% packet loss, time 3022ms
  • If I understand correctly, you want to add public IP addresses to an EC2 instance. For that you don't need to configure anything in the instance; the private IP is given and configured by AWS, don't change the network configuration. You can add ("attach") an elastic public IP to your instance from your web control panel for example, again, no need to touch network configuration files (IP will resolve to public hostname). Apr 20, 2014 at 21:34
  • For an ADDITIONAL IP? I'm talking two or more. Not the default IP. That one was working fine without modifying the configuration.
    – Sam Levin
    Apr 21, 2014 at 0:06
  • Also, I'm not using the amazon Linux, I'm using Debian AMI
    – Sam Levin
    Apr 21, 2014 at 1:31
  • It doesn't matter what Linux version your EC2 instance is using, you can just add public elastic IPs that will resolve to your EC2 instance's public domain name, no need to alter any network config file in your instance, just add them from your AWS web dashboardd. Apr 21, 2014 at 1:55
  • Wouldn't that defeat the purpose?
    – Sam Levin
    Apr 22, 2014 at 1:11

2 Answers 2


I had a similar issue but I was able to solve it by modifying the routing. I had to add these routes in my /etc/networking/interfaces file:

auto lo
iface lo inet loopback
auto eth0
iface eth0 inet dhcp
post-up ip route add default via g.g.g.g dev eth0 tab 1
post-up ip rule add from x1.x1.x1.x1/32 tab 1 priority 500

auto eth1
iface eth1 inet dhcp
post-up ip route add default via g.g.g.g dev eth1 tab 2
post-up ip rule add from x2.x2.x2.x2/32 tab 2 priority 600

where x1.x1.x1.x1 and x2.x2.x2.x2 are my Private IP addresses. g.g.g.g is the IP gleaned from the existing route table. To get it, run ip route show on the command line and make a note of the IP with the line default via g.g.g.g dev eth0

Once I rebooted networking, everything worked.

I was able to piece this together through the following forum post on AWS: https://forums.aws.amazon.com/message.jspa?messageID=404454


You don't have to make any change to your instance network settings. If you configured EIP and associate them with your ENI's it will work. I suggest you to control your security group settings.

  • My security group settings are currently allowing all inbound and outbound. Also what's the point of doing this if both EIP addresses resolve to the public IP? I cannot accomplish what I want (SSL on multiple hosts) if all my EIPs resolve to a single domain. Also I've tried what you've suggested. I restored my network settings on the instance. My second EIP isn't resolving. Should I delete/create a new ENI?
    – Sam Levin
    Apr 21, 2014 at 12:20
  • Also, why does this tutorial say that in order to do this, I DO have to change my network settings? github.com/niftylettuce/amazon-vpc-ec2-multiple-ip-addresses - I'm thinking that you don't need to altar your network configuration ONLY when you're using the amazon Linux dist
    – Sam Levin
    Apr 21, 2014 at 12:29
  • @SamLevin that tutorial is for instances in Amazon's Virtual Private Cloud, where you control the networking settings. Apr 21, 2014 at 16:35
  • I see. Would I be better off going in that direction? I restored the stock networking configuration on my instance and the second elastic IP is still not resolving. Should I delete the ENI and try again? Also, when this works, in theory, the EIPs will resolve to different private IPs, allowing me to differentiate what interface specific traffic comes in on? (Eg for apache virtual hosts)
    – Sam Levin
    Apr 21, 2014 at 18:38

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.