22

I have created a VPC in aws with a public subnet and a private subnet. The private subnet does not have direct access to external network. So, there is a NAT server in public subnet which forward all outbound traffic from private subnet to outer network.

Currently, I can SSH from public subnet to private subnet, also SSH from NAT to private subnet. However, what I want is SSH from any machine(home laptop, office machine and mobile) to instances in private subnet.

I have done some research that I can setup the NAT box to forward SSH to instance in private subnet. But I got not luck for this.

Can anyone list what I need to setup to make this possible.

Naming are :

laptop (any device outside the VPC)

nat (the NAT server in the public subnet)

destination (the server in the private subnet which I want to connect to)

Not sure following are limitations or not:

The "destination" does not have a public IP, only a subnet ip, for example 10.0.0.1 The "destination" can not connect to "nat" via nat's public. There are several "destination" servers, do I need to setup one for each?

Thanks

Improve this question
1
  • This link outlines the steps required to connect to EC2 instances in Private Subnet through SSH Agent Forwarding.
    – Shailender Rawat
    Apr 7, 2015 at 5:08

3 Answers 3

Reset to default
37

You can set up a bastion host to connect to any instance within your VPC:

http://blogs.aws.amazon.com/security/post/Tx3N8GFK85UN1G6/Securely-connect-to-Linux-instances-running-in-a-private-Amazon-VPC

You can choose to launch a new instance that will function as a bastion host, or use your existing NAT instance as a bastion.

If you create a new instance, as an overview, you will:

1) create a security group for your bastion host that will allow SSH access from your laptop (note this security group for step 4)

2) launch a separate instance (bastion) in a public subnet in your VPC

3) give that bastion host a public IP either at launch or by assigning an Elastic IP

4) update the security groups of each of your instances that don't have a public IP to allow SSH access from the bastion host. This can be done using the bastion host's security group ID (sg-#####).

5) use SSH agent forwarding (ssh -A user@publicIPofBastion) to connect first to the bastion, and then once in the bastion,SSH into any internal instance (ssh user@private-IP-of-Internal-Instance). Agent forwarding takes care of forwarding your private key so it doesn't have to be stored on the bastion instance (never store private keys on any instance!!)

The AWS blog post above should be able to provide some nitty gritty regarding the process. I've also included the below in case you wanted extra details about bastion hosts:

Concept of Bastion Hosts: http://en.m.wikipedia.org/wiki/Bastion_host

If you need clarification, feel free to comment.

Improve this answer
3
  • 3
    Be sure to allow SSH/22 on both inbound and outbound on the bastion.
    – user464180
    Nov 3, 2015 at 16:22
  • This is such a critical point that it must be a part of the answer!
    – Tariq
    Jul 27, 2018 at 18:17
  • In addition to the accepted answer which help a lot but not entirely, I had to make sure that security groups allow inbound and outbound traffic. At first glance it looked like they already do, but since I used CloudFormation template, I hadn't noticed that the source for incoming traffic to the private subnet was my ELB. So, it allowed all traffic but only coming from ELB. Changing that to my public subnet fixed the problem.
    – Milan Markovic
    Jan 30, 2019 at 12:03
1

The only way I could make it work.

1) Make sure that the security group for this private instance has in the inbound rule the security group from the public subnet

Ports Protocol Source
All All sg-0b6616e070b9ea2d (public security group)

2) Using proxy commands, configure your ssh config file, to have something like this

vim ~/.ssh/config

Host publichost
   HostName 24.123.34.45
   User ubuntu
   IdentityFile ~/mypem.pem
   ProxyCommand none
Host privatehost
   HostName 10.0.2.133
   User ubuntu
   IdentityFile ~/mypem.pem
   ProxyCommand ssh publichost -W %h:%p

Run ssh privatehost it should work

Improve this answer
1
  • So did you use a bastion or not?
    – digout
    Apr 1, 2020 at 13:52
0

Just to clarify: once you've ssh'd into your bastion host, you need to ssh into the NAT host as user ec2-user. This trumped me up a bit, since normally the ubuntu user is ubuntu on AWS. So I did:

laptop> ssh -A ubuntu@ssh_bastion
ssh_bastion> ssh ec2-user@nat_private_dns_or_private_ip

Also, remember that your ssh_bastion should have an outbound rule that allows traffic out to other hosts and sg's.

Improve this answer
2
  • Is that 'ec2_user' name as a result of spinning up an Amazon AMI specifically, already configured for NAT service? So, how did 'ec2-user' get an account on the private machine?
    – Dennis
    Jul 22, 2015 at 23:13
  • and directly how can you establish a ssh connection to the private instance (through the bastion ) from your local computer?
    – Joaquin Diaz
    Sep 2, 2020 at 14:19

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .