Infrastructure setup:

  1. VPC is created with netwok
  2. Private subnet within VPC (Virtual Private Cloud) is created with network
  3. Public subnet within the VPC is created with network
  4. There are 5 odd number of ubuntu servers in Private subnet which are accessing internet through the jump server (this is also a ubuntu server) created in Public subnet
  5. One web server is also there with the jump server in Public subnet.
  6. Only jump server and Web server which are in public subnet are associated with Elastic IP / Public IP. (both the servers have their own elastic / public ip's)
  7. Jump server has two private IP's from Public subnet assigned to 2 different physical ethernet adapters

    • (eth0 - primary) this IP also has Elastic IP / Public IP assigned to it
    • (eth1 - secondary) This IP does not have elastic IP assigned
  8. Web server which is in public subnet has private IP assigned
  9. All servers from Private subnet do not have internet gateway as their internet traffic is routed through the Jump Server which is in Public Subnet.
  10. Private subnet also does not have internet gateway assigned in it's route
  11. All servers from Private subnet are able to get internet connection successfully through the jump server without any issue.
  12. Complete range of Private subnet is allowed in Public Subnet though the routing and Security group i.e. firewall on all protocols and all ports and vice a versa from Public subnet to private subnet.
  13. All servers from Public subnet are able to ping or connect on ip which primary IP of the jump server, but they are not able to ping the secondary ip which is
  14. From jump server I am able to ping both the Private Ip's assigned to it.
  15. Web Server which is in the Public subnet is also able to ping only primary IP of the jump server.
  16. Jump server is a t2.micro instance and as per aws documentation here we shall be able able use 2 physical NIC's with it.
  17. From Jump server we have allowed IPv4 forwarding and it is working fine.
  18. From jump server it shows both the NIC's are up and running

Below are few more details from Jump Server:

root@ip-192-168-254-135:~# ifup eth1
Internet Systems Consortium DHCP Client 4.2.4
Copyright 2004-2012 Internet Systems Consortium.
All rights reserved.
For info, please visit https://www.isc.org/software/dhcp/

Listening on LPF/eth1/0e:f8:f2:11:7d:bd
Sending on   LPF/eth1/0e:f8:f2:11:7d:bd
Sending on   Socket/fallback
DHCPDISCOVER on eth1 to port 67 interval 3 (xid=0x651f3853)
DHCPREQUEST of on eth1 to port 67 (xid=0x651f3853)
DHCPACK of from
bound to -- renewal in 1602 seconds.
root@ip-192-168-254-135:~# ifconfig -a | egrep 'eth|inet.*192.168'
eth0      Link encap:Ethernet  HWaddr 0e:1c:ca:ae:cd:3e
          inet addr:  Bcast:  Mask:
eth1      Link encap:Ethernet  HWaddr 0e:f8:f2:11:7d:bd
          inet addr:  Bcast:  Mask:
root@ip-192-168-254-135:~# route -n
Kernel IP routing table
Destination     Gateway         Genmask         Flags Metric Ref    Use Iface         UG    0      0        0 eth0 U     0      0        0 eth0 U     0      0        0 eth1
root@ip-192-168-254-135:~# ip rule list
0:      from all lookup local
32766:  from all lookup main
32767:  from all lookup default
root@ip-192-168-254-135:~# ping -c2
PING ( 56(84) bytes of data.
64 bytes from icmp_seq=1 ttl=64 time=0.031 ms
64 bytes from icmp_seq=2 ttl=64 time=0.039 ms

--- ping statistics ---
2 packets transmitted, 2 received, 0% packet loss, time 999ms
rtt min/avg/max/mdev = 0.031/0.035/0.039/0.004 ms
root@ip-192-168-254-135:~# ip route list
default via dev eth0 dev eth0  proto kernel  scope link  src dev eth1  proto kernel  scope link  src

root@ip-192-168-254-135:~# cat /etc/iproute2/rt_tables
###### reserved values
255     local
254     main
253     default
0       unspec
###### local
######1      inr.ruhep

Can anyone explain me why we are not able to ping the secondary IP of the Jump server from anywhere apart than the jump server itself. All other servers from Private and Public subnet are able to ping jump servers Primary IP but not the secondary IP. Jump server and all other servers from both the subnets allow all incoming traffic / connections from all Subnets of the VPC from their respective local firewall.


You have 2 options to fix the problem.

1) Assign 2 IPs to eth0(it is possible from ec2 console), you will need to use "ip addr add ..." to configure the second IP. 2) Configure source based routing. Possible answer: https://superuser.com/questions/638044/source-based-policy-routing-nat-dnat-snat-aka-multi-wans-on-centos-5

  • Hi, thanks for the answer though, I can't use this solution as I am going to use that virtual network adapter for some other purpose later :(
    – Hrish
    Dec 24 '14 at 12:38
  • If you can keep the interfaces on separate subnets, that would also do the job. But I'm guessing that you don't want that.
    – DerekC
    Dec 24 '14 at 12:50
  • Hi, Yes you are right, I am going to use four Private IP's but from Same subnet :(
    – Hrish
    Dec 25 '14 at 3:45

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.