4

I am playing a bit with AWS. I created one VPC (with 10.1.0.0./24 net) and two EC2 instances attached to it. One EC2 has 10.1.0.4, second 10.1.0.5 . I allocated one Elastic IP to VPC and associated it to Network Interface which belongs to 10.1.0.4 EC2 instance. The VPC is a custom one created by me. One of the most importand thing for me is, that public IP must retain (payment provider requires this). The problem is, that from first EC2 (10.1.0.4) I can access Internet but from second one (10.1.0.5) it's totally impossible. It must be said, that first EC2 (.0.4) should be WebServer while second one (.0.5) is a database server.

What am I doing wrong? Is above configuration good for what I want to achieve?

Thank you in advance for any tip.

Piotr

Improve this question

4 Answers 4

Reset to default
9

Instances in a VPC only have access to the public internet if they have an Elastic IP or if their subnet is routed through a NAT instance. Assign an Elastic IP (if you like, you can have this done automatically on launch so you don't have to worry about associating/deassociating) and it'll have access.

Improve this answer
4
  • There is high possibility, that in the future this infrastructure will grow up. So it looks like I need to go detailed with docs.aws.amazon.com/AmazonVPC/latest/UserGuide/… in order to avoid issues later, am I correct ?
    – Piotr
    Sep 15, 2014 at 13:11
  • 1
    @Piotr I find the NAT instances to be a pain to manage and a point of failure. I prefer public subnets, automatically assigned Elastic IPs, and security groups / firewall rules to protect stuff.
    – ceejayoz
    Sep 15, 2014 at 13:53
  • That is easier to implement solution for sure, but what if my infrastructure grows to 6 EC2? As far as I know I can have only 5 ElasticIP...
    – Piotr
    Sep 15, 2014 at 13:59
  • 1
    @Piotr Automatically assigned EIPs are not counted against that total. You can also get Amazon to raise your limit if you have a reasonable use case.
    – ceejayoz
    Sep 15, 2014 at 14:26
11

Not quite sure the answer flagged as correct is actually correct.

Every Amazon account now has a default VPC (this wasn't always the case) which has an Internet Gateway, an RFC 1918 subnet and a Default route table which routes all non-local traffic to the Internet.

Depending on which VPC you are operating in, deployed instances will or will not have a public IP address attached to them by default. Any instance deployed in the default VPC will have a public IP address attached. Any instance launched in a non-default VPC will not unless you specify that it should.

A public IP address is not the same as an Elastic IP address, in that a public IP address is ephemeral (ie once you stop the instance, you lose that address)

If you have launched your instance with the option to attach a public IP, and launched into the default VPC, there should be no requirement to attach an Elastic IP address.

You should be able to launch hundreds of instances with internet access, without the need to have Elastic Ip addresses attached to each.

I imagine your issue is that you launched one of your instances into a non-default VPC without the option to attach a public IP address.

See: Amazon EC2 Instance IP Addressing.

Improve this answer
3
  • Thank you for feedback. I updated question with more details. That is why I belive, that @ceejayoz answer fits best.
    – Piotr
    Sep 15, 2014 at 17:29
  • That is as may be, but this statement "Instances in a VPC only have access to the public internet if they have an Elastic IP or if their subnet is routed through a NAT instance." is technically incorrect.
    – Garreth McDaid
    Sep 15, 2014 at 22:25
  • @GarrethMcDaid the VPC FAQ still states that as well, but I believe your answer is correct. I have instances running now with public IP's in a VPC with an IGW, no NAT, no EIP, and it can access the internet just fine.
    – Nick Triantafillou
    Sep 15, 2015 at 4:15
3

By default there is no internet access to the VPC .

On your VPC dashboard click Route Tables then click Routes. Click Edit, then add the following information : 0.0.0.0/0 & InternetGateWayName. Click Save . That's it .

Improve this answer
1
  • 1
    This only applies for non-default VPCs.
    – Garreth McDaid
    May 4, 2016 at 7:28
1

Under the VPC Dashboard >> Route Tables

Make sure the route table for your VPC has CIDR block assigned to your Internet Gateway (VPC Dashboard >> Internet Gateway)

Destination    Target         Status    Propagated
172.31.0.0/16  local          Active    No
0.0.0.0/0      igw-8fc8d4ed   Active    No

The Example above shows the CIDR block 0.0.0.0/0 assigned to gateway igw-8fc8d4ed

Improve this answer
2
  • This is configured by default, I believe.
    – Piotr
    Sep 15, 2014 at 15:07
  • 1
    On the default VPC sure, but if you start creating your own then it's not set.
    – George Rushby
    Sep 16, 2014 at 9:37

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .