4

I am playing a bit with AWS. I created one VPC (with 10.1.0.0./24 net) and two EC2 instances attached to it. One EC2 has 10.1.0.4, second 10.1.0.5 . I allocated one Elastic IP to VPC and associated it to Network Interface which belongs to 10.1.0.4 EC2 instance. The VPC is a custom one created by me. One of the most importand thing for me is, that public IP must retain (payment provider requires this). The problem is, that from first EC2 (10.1.0.4) I can access Internet but from second one (10.1.0.5) it's totally impossible. It must be said, that first EC2 (.0.4) should be WebServer while second one (.0.5) is a database server.

What am I doing wrong? Is above configuration good for what I want to achieve?

Thank you in advance for any tip.

Piotr

9

Instances in a VPC only have access to the public internet if they have an Elastic IP or if their subnet is routed through a NAT instance. Assign an Elastic IP (if you like, you can have this done automatically on launch so you don't have to worry about associating/deassociating) and it'll have access.

  • There is high possibility, that in the future this infrastructure will grow up. So it looks like I need to go detailed with docs.aws.amazon.com/AmazonVPC/latest/UserGuide/… in order to avoid issues later, am I correct ? – Piotr Sep 15 '14 at 13:11
  • 1
    @Piotr I find the NAT instances to be a pain to manage and a point of failure. I prefer public subnets, automatically assigned Elastic IPs, and security groups / firewall rules to protect stuff. – ceejayoz Sep 15 '14 at 13:53
  • That is easier to implement solution for sure, but what if my infrastructure grows to 6 EC2? As far as I know I can have only 5 ElasticIP... – Piotr Sep 15 '14 at 13:59
  • 1
    @Piotr Automatically assigned EIPs are not counted against that total. You can also get Amazon to raise your limit if you have a reasonable use case. – ceejayoz Sep 15 '14 at 14:26
11

Not quite sure the answer flagged as correct is actually correct.

Every Amazon account now has a default VPC (this wasn't always the case) which has an Internet Gateway, an RFC 1918 subnet and a Default route table which routes all non-local traffic to the Internet.

Depending on which VPC you are operating in, deployed instances will or will not have a public IP address attached to them by default. Any instance deployed in the default VPC will have a public IP address attached. Any instance launched in a non-default VPC will not unless you specify that it should.

A public IP address is not the same as an Elastic IP address, in that a public IP address is ephemeral (ie once you stop the instance, you lose that address)

If you have launched your instance with the option to attach a public IP, and launched into the default VPC, there should be no requirement to attach an Elastic IP address.

You should be able to launch hundreds of instances with internet access, without the need to have Elastic Ip addresses attached to each.

I imagine your issue is that you launched one of your instances into a non-default VPC without the option to attach a public IP address.

See: Amazon EC2 Instance IP Addressing.

  • Thank you for feedback. I updated question with more details. That is why I belive, that @ceejayoz answer fits best. – Piotr Sep 15 '14 at 17:29
  • That is as may be, but this statement "Instances in a VPC only have access to the public internet if they have an Elastic IP or if their subnet is routed through a NAT instance." is technically incorrect. – Garreth McDaid Sep 15 '14 at 22:25
  • @GarrethMcDaid the VPC FAQ still states that as well, but I believe your answer is correct. I have instances running now with public IP's in a VPC with an IGW, no NAT, no EIP, and it can access the internet just fine. – Nick Triantafillou Sep 15 '15 at 4:15
3

By default there is no internet access to the VPC .

On your VPC dashboard click Route Tables then click Routes. Click Edit, then add the following information : 0.0.0.0/0 & InternetGateWayName. Click Save . That's it .

  • This only applies for non-default VPCs. – Garreth McDaid May 4 '16 at 7:28
1

Under the VPC Dashboard >> Route Tables

Make sure the route table for your VPC has CIDR block assigned to your Internet Gateway (VPC Dashboard >> Internet Gateway)

Destination    Target         Status    Propagated
172.31.0.0/16  local          Active    No
0.0.0.0/0      igw-8fc8d4ed   Active    No

The Example above shows the CIDR block 0.0.0.0/0 assigned to gateway igw-8fc8d4ed

  • This is configured by default, I believe. – Piotr Sep 15 '14 at 15:07
  • 1
    On the default VPC sure, but if you start creating your own then it's not set. – George Rushby Sep 16 '14 at 9:37

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.