AWS connect to private subnet instance without going through NAT

Question

First of all, I know this is not something you should always do but for now It would save many hours if it were in fact possible.

I am able to do the following:

ssh (with .pem) -> NAT -> ssh to private subnet instance -> success

I want to be able to do bypass the NAT part and go straight to the private instance.

I have also assigned my private instance a public ip but attempts to connect just hang and eventually time out.

The results of the ssh with -vvv specified

ssh -vvv -A ec2-user@<public-IP>
OpenSSH_6.2p2, OSSLShim 0.9.8r 8 Dec 2011
debug1: Reading configuration data /etc/ssh_config
debug1: /etc/ssh_config line 20: Applying options for *
debug2: ssh_connect: needpriv 0
debug1: Connecting to <public-IP> [<public-IP>] port 22.
debug1: connect to address <public-IP> port 22: Operation timed out
ssh: connect to host <public-IP> port 22: Operation timed out

The ssh rule is present the the security group

SSH TCP 22 0.0.0.0/0

Do I need to add the route to the route table(s) or something along those lines? I understand that as it is private it shouldn't be accessed in this manner, but its a temporary solution to test new applications, there are no security implications currently as everything is being ran with dummy data and the instances will be remade before real deployment.

I have added a security group rule which allows TCP port 22 for ssh inbound connections and still no success when attempting to access via the assigned public ip.

Any help would be appreciated.

Answer 1

if you want to ssh your instance without NAT, it has to be reachable from your network (where your laptop is). thus I see two solutions:

• set an elastic IP to your instance + internet gateway/route to your subnet. An elastic IP without internet gateway is not enough, as traffic will not be routed properly. However, if you set up an Internet gateway, the NAT becomes useless
• The proper way to do would be to use a VPN solution, such as openvpn (you can find an openvpn AMI, all configured from aws community). for example, see this thread for further details on VPN