I have created a VPC in aws with a public subnet and a private subnet. The private subnet does not have direct access to external network. So, there is a NAT server in public subnet which forward all outbound traffic from private subnet to outer network.

Currently, I can SSH from public subnet to private subnet, also SSH from NAT to private subnet. However, what I want is SSH from any machine(home laptop, office machine and mobile) to instances in private subnet.

I have done some research that I can setup the NAT box to forward SSH to instance in private subnet. But I got not luck for this.

Can anyone list what I need to setup to make this possible.

Naming are :

laptop (any device outside the VPC)

nat (the NAT server in the public subnet)

destination (the server in the private subnet which I want to connect to)

Not sure following are limitations or not:

The "destination" does not have a public IP, only a subnet ip, for example 10.0.0.1 The "destination" can not connect to "nat" via nat's public. There are several "destination" servers, do I need to setup one for each?

Thanks

  • This link outlines the steps required to connect to EC2 instances in Private Subnet through SSH Agent Forwarding. – Shailender Rawat Apr 7 '15 at 5:08
up vote 16 down vote accepted

You can set up a bastion host to connect to any instance within your VPC:

http://blogs.aws.amazon.com/security/post/Tx3N8GFK85UN1G6/Securely-connect-to-Linux-instances-running-in-a-private-Amazon-VPC

You can choose to launch a new instance that will function as a bastion host, or use your existing NAT instance as a bastion.

If you create a new instance, as an overview, you will:

1) create a security group for your bastion host that will allow SSH access from your laptop (note this security group for step 4)

2) launch a separate instance (bastion) in a public subnet in your VPC

3) give that bastion host a public IP either at launch or by assigning an Elastic IP

4) update the security groups of each of your instances that don't have a public IP to allow SSH access from the bastion host. This can be done using the bastion host's security group ID (sg-#####).

5) use SSH agent forwarding (ssh -A user@publicIPofBastion) to connect first to the bastion, and then once in the bastion,SSH into any internal instance (ssh user@private-IP-of-Internal-Instance). Agent forwarding takes care of forwarding your private key so it doesn't have to be stored on the bastion instance (never store private keys on any instance!!)

The AWS blog post above should be able to provide some nitty gritty regarding the process. I've also included the below in case you wanted extra details about bastion hosts:

Concept of Bastion Hosts: http://en.m.wikipedia.org/wiki/Bastion_host

If you need clarification, feel free to comment.

  • 2
    Be sure to allow SSH/22 on both inbound and outbound on the bastion. – user464180 Nov 3 '15 at 16:22
  • This is such a critical point that it must be a part of the answer! – Tariq Jul 27 at 18:17

Just to clarify: once you've ssh'd into your bastion host, you need to ssh into the NAT host as user ec2-user. This trumped me up a bit, since normally the ubuntu user is ubuntu on AWS. So I did:

laptop> ssh -A ubuntu@ssh_bastion
ssh_bastion> ssh ec2-user@nat_private_dns_or_private_ip

Also, remember that your ssh_bastion should have an outbound rule that allows traffic out to other hosts and sg's.

  • Is that 'ec2_user' name as a result of spinning up an Amazon AMI specifically, already configured for NAT service? So, how did 'ec2-user' get an account on the private machine? – Dennis Jul 22 '15 at 23:13

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.