I am a little new the Amazon EC2 and to networking, so I apologize in advance if this is a stupid question.

I want to create a VPC in EC2 with two subnets: public for the web application instance, and private for databases instances.

The thing is, my application requires several external IPs. I actually just need to initiate curl calls from the private instance(s) to different external IPs. Each private instance should have access to all external IPs. For the incoming route, one IP should be enough.

Using VPC&NAT gateways I was able to make curl from the private instance to internet pages, but I was only able to connect one elastic IP to a NAT, and I have found no way to add additional elastic IPs to existing NAT.

I think that I can make it work with putting two proxy servers on an instance in the public subnet listening on two ports and forwarding to the elastic IPs, but I couldn't get rid of the HTTP_X_FORWARDED_FOR in the header.

I imagine that it must be possible somehow. It should be similar to the case of several websites with different IPs in the same VPC. Is there a way to do that?

You can add multiple elastic network interfaces to an instance, though the smaller the instance the fewer interfaces / IPs you can have - there's a chart somewhere but I can't find it right now. You can attach multiple EIPs to each ENI, and you can have multiple ENIs.

There are two types of NAT instances:

  • An instance you create yourself
  • A managed NAT gateway

The type you create yourself will be more flexible as you can add ENIs, but likely less reliable than the AWS managed NAT gateways. I think that's the type you'll need given your requirements.

That header is typically added by an elastic load balancer. Not sure how to remove it.

I'm not sure about your query "It should be similar to the case of several websites with different IPs in the same VPC. Is there a way to do that?". You can host as many websites as you like in a VPC, either on one or multiple instances. I host five domains / websites on one t2.micro, but large websites can be behind an ELB and can have dozens or hundreds of servers providing the site. I think you need to be more specific about what you're trying to achieve here.

  • thanks for the explanation. about the query: I meant that each website will have its own, different, public (dedicated) IP. Sounds to me like something that should be a fairly common. To make sure that I understood correctly: You suggest that I will try instance NAT (instead of managed NAT) and that way I will be able to add more EIPs to them? – justadev Sep 18 '16 at 20:40
  • One IP per website is fine. Multiple websites per IP is fine. You can do whatever you like. You will have to decide whether managed NAT or instance NAT is appropriate for your use case, you haven't given enough detail to make the best option clear. – Tim Sep 18 '16 at 20:54
  • Before I wrote the question I already tried managed NAT (through: console.aws.amazon.com/vpc). After it was created, I didn't find any way to add an additional elastic IP to it. If I remember correctly, the error that I received was that "you are not authorized to edit this resource" (this was when I tried to add additional private IP to the network interface created by the wizard). I am trying now the NAT instance approach, I hope it will work. If you know how to add additional IP to the managed NAT I will be happy if you share. – justadev Sep 18 '16 at 21:16
  • NAT Gateway is only for natting outbound traffic (TCP, UDP, and ICMP) -- that is, traffic initiated by the instances behind it, with their private IP addresses, using the single Elastic IP attached to the gateway when accessing the Internet. NAT instances are intended for similar purposes. For instances with multiple external addresses, you attach the EIPs directly to the instance and use policy routing on the instances for reply traffic to be routed correctly. The Internet Gateway handles the 1:1 NAT to the instance's private addresses transparently. – Michael - sqlbot Sep 18 '16 at 21:45
  • 1
    ...but there is rarely a reason why multiple web sites means multiple IP addresses any more. Virtual (name-based) hosting and SNI make that unnecessarily wasteful. – Michael - sqlbot Sep 18 '16 at 21:46

Your Answer

 

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.