I'm trying to configure outgoing internet access over "NAT Gateway" for several EC2 instances, so that f.e.
curl ifconfig.co returns the same ip for all instances & the outside statistics server they connect to show the same ip.
At the same time these instances must be still accessible over their public IPs (each ec2 instance has it own public ip), be accessible for ssh , serve web content & be accessible for each other on their private ips.
Instances had only eth0 interfaces with 10.0.1.0/24 subnet addresses on it (www1). I cannot see the interface for the public ip with ifconfig, but I guess it's an expected behavior for ec2 instances. They are all behind the Elastic Load Balancer.
I've created a second subnet www2 with CIDR block = 10.0.3.0/24.
I've created a NAT Gateway & assigned an Elastic ip to it & chose the subnet www2. The private ip of the NAT Gateway is shown correctly as 10.0.3.132.
I've created the network interface in EC2->Network interfaces for one of the instances with the subnet 10.0.3.0 selected + private ip auto assign + security group same as for other instances which has SSH TCP 22 0.0.0.0/0 for inbound rules & all traffic 0-65535 0.0.0.0/0 for outbound traffic.
The instance indeed got the second eth1 interface after with the correct ip=10.0.3.31 auto-assigned to it. Here's the ip route show from that instance:
ip route show default via 10.0.1.1 dev eth0 default via 10.0.3.1 dev eth1 metric 10001 10.0.1.0/24 dev eth0 proto kernel scope link src 10.0.1.69 10.0.3.0/24 dev eth1 proto kernel scope link src 10.0.3.31 169.254.169.254 dev eth0
Here's the ifconfig:
ifconfig eth0 Link encap:Ethernet HWaddr 0A:65:1C:28:80:7E inet addr:10.0.1.69 Bcast:10.0.1.255 Mask:255.255.255.0 inet6 addr: fe80::865:1cff:fe28:807e/64 Scope:Link inet6 addr: 2600:1f18:4328:e200:4f10:db4d:6a56:d900/64 Scope:Global UP BROADCAST RUNNING MULTICAST MTU:9001 Metric:1 RX packets:10978429 errors:0 dropped:0 overruns:0 frame:0 TX packets:8536463 errors:0 dropped:0 overruns:0 carrier:0 collisions:0 txqueuelen:1000 RX bytes:26095196998 (24.3 GiB) TX bytes:2202490320 (2.0 GiB) eth1 Link encap:Ethernet HWaddr 0A:9D:28:92:38:0E inet addr:10.0.3.31 Bcast:10.0.3.255 Mask:255.255.255.0 inet6 addr: fe80::89d:28ff:fe92:380e/64 Scope:Link UP BROADCAST RUNNING MULTICAST MTU:9001 Metric:1 RX packets:262217 errors:0 dropped:0 overruns:0 frame:0 TX packets:197708 errors:0 dropped:0 overruns:0 carrier:0 collisions:0 txqueuelen:1000 RX bytes:237017161 (226.0 MiB) TX bytes:50706247 (48.3 MiB) lo Link encap:Local Loopback inet addr:127.0.0.1 Mask:255.0.0.0 inet6 addr: ::1/128 Scope:Host UP LOOPBACK RUNNING MTU:65536 Metric:1 RX packets:420172 errors:0 dropped:0 overruns:0 frame:0 TX packets:420172 errors:0 dropped:0 overruns:0 carrier:0 collisions:0 txqueuelen:1 RX bytes:1399654528 (1.3 GiB) TX bytes:1399654528 (1.3 GiB)
After that if I go to VPC dashboard->Route tables->Edit routes for the appropriate routing table for all of my instances & set "nat-06931899c65346b40" instead of igw-fd92cc9a for 0.0.0.0/0 in destination I get disconnected from the ssh session & the website hosted on the instance becomes unavailable. I guess it's expected as it is behind NAT now.
BTW it didn't look good to me that the security group of the NAT Gateway in the EC2->Network interfaces is empty, but when I try to set it to the same as the other instances (or any other at all) with "change security groups" I get "You do not have permission to access the specified resource."
So I'd like my instances to be accessible over their public ips over http & ssh, but to report the same ip with
The goal is not to edit the routing table on each instance manually as we prepare for auto-scaling & use the aws web console provided options.
But even if I do it manually, how exactly do I edit the routes to achieve my goal?
The general network scheme before adding the NAT Gateway was: VPC Internet gateway <-> ELB <-> ec2 instances (with public ips accessible). The web content from the instances is served through the ELB, but the instances themselves are available for ssh over their public ips directly.
Thanks in advance!