AWS is not setting up properly default gw for instance in private subnet.

NAT address:

ec2din i-ef7f8a3a|grep PRIVATEIPADDRESS

ROUTING TABLE configuration:

ec2drtb rtb-7c9f3618
ROUTETABLE  rtb-7c9f3618    vpc-43da3455
ROUTE   local       active           CreateRouteTable
ROUTE       i-ef7f8a3a  active   eni-4055320a        CreateRoute
ASSOCIATION rtbassoc-cc1764a8   main
ASSOCIATION rtbassoc-51b7c435   subnet-c92429be`

PRIVATE SUBNET configuration:

ec2dsubnet subnet-c92429be
SUBNET  subnet-c92429be available   vpc-43da3455   250 us-east-1a  false   false
TAG subnet  subnet-c92429be`

Like we see I configured instance i-ef7f8a3a as NAT, and set it in routing table as default gw for all traffic.

When I login to my machine started in private subnet ( and check the routing table it is not showing default gw as ip of my NAT instance, instead, it redirects to default router:

ip r
default via dev eth0 
default via dev eth0  metric 1024 dev eth0  proto kernel  scope link  src dev eth0  scope link  metric 1024`

Default route on NAT is set up as not to igw, so I thought all magic is done on AWS router and it will redirect to my NAT anyway, so I start tests.

I try to ping some outside IP and I start tcpdump on my nat instance but I dont see any incoming packets from my private subnet:

PING ( 56(84) bytes of data.
--- ping statistics ---
20 packets transmitted, 0 received, 100% packet loss, time 19150ms`

tcpdump -n host
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on eth0, link-type EN10MB (Ethernet), capture size 262144 bytes
0 packets captured
0 packets received by filter
0 packets dropped by kernel`

Both instances can "see" each other -- I can ssh in both directions, but when I even try to set up default route with my NAT as gw im getting:

ip r add default via
RTNETLINK answers: Network is unreachable

Did I miss something? How should the route table look on an instance on private subnet? Should my NAT IP be there, or the default?


Leave the IP stack on the instances alone. The default gateway it picks up from DHCP is correct, and routing to the NAT instance is done by the VPC infrastructure.

The security group on your NAT instance needs to be configured to accept all traffic from (you can set it more restrictive if needed, but you first need to get it working).

You also need to disable the source/destination check on the NAT instance.

  • Here are my security settings for NAT instance: [root@ec2manage ~]# ec2din i-ef7f8a3a|grep GROUP GROUP sg-d1fdbfb6 gwgrp [root@manage01 ~]# ec2dgrp sg-d1fdbfb6 GROUP sg-d1fdbfb6 640607819574 gwgrp sec grp for gateaway instance vpc-6c8c4908 PERMISSION 640607819574 gwgrp ALLOWS tcp 22 22 FROM CIDR ingress PERMISSION 640607819574 gwgrp ALLOWS all TO CIDR egress [root@ec2manage ~]# and source/destination settings: ~]# ec2dinatt --source-dest-check i-ef7f8a3a sourceDestCheck i-ef7f8a3a false – user3069488 Sep 5 '15 at 9:15
  • Got it, i had only allowed ssh connection from everywhere to my nat instance, that is why pings did not go through. Thank you – user3069488 Sep 5 '15 at 9:22

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.