0

Really struggling to pin point a network gateway issue in EC2.

I've set a new machine. Exact same Security groups, subnet and VPC setup as previous one and am trying to ping third machine..

Tcp dump from the 3rd server shows similar response from these two machines I am comparing:

$> tcpdump -qtln icmp
listening on eth0, link-type EN10MB (Ethernet), capture size 65535 bytes
IP NEW_MACHINE > THIRD_MACHNE: ICMP echo request, id 2750, seq 1, length 64
IP THIRD_MACHNE > NEW_MACHINE: ICMP echo reply, id 2750, seq 1, length 64
IP OLD_MACHINE > NEW_MACHINE: ICMP echo request, id 63237, seq 1, length 64
IP NEW_MACHINE > OLD_MACHINE: ICMP echo reply, id 63237, seq 1, length 64

iptables are empty (iptables -L).

When I ping from old machine, I get back a response and all is well, from the new machine, 100% packet loss:

[root@ansible-1-1b network-scripts]#  ping -v THIRD_MACHINE
PING THIRD_MACHINE (THIRD_MACHINE) 56(84) bytes of data.
^C
--- THIRD_MACHINE ping statistics ---
16 packets transmitted, 0 received, 100% packet loss, time 15365ms

These are EC2 machines, in same VPC and as far as I can tell Ec2 config is similar (same vpc, same security groups, no specific rules for either machines) Any ideas where I should next be looking at?

The one major diff I see is the working machine:

uname -r
2.6.32-696.6.3.el6.x86_64

vs the failing one:

uname -r
4.9.43-17.39.amzn1.x86_64

Security Groups from AWS, for the two pinging machines: Client security group

On the target machine: Server sg setup

Maybe a new flag I am missing?

For what it's worth I use ping for the test, but SSH is timing out just as well.

  • 1
    Can you post the security group configuration? – Federico Galli Oct 11 '17 at 9:56
  • Sure.. (Upload to serverfault does not seem to work, added direct github links... :() – JAR.JAR.beans Oct 11 '17 at 11:13
  • Is that port -1 correct? – Federico Galli Oct 11 '17 at 13:04
  • You allow ICMP from all address (0.0.0.0/0) on the working machine, but only from 10.2/16 and 10.20/16 on the server. Can you try opening up ICMP from all and retrying? – Daryl Metzler Oct 13 '17 at 5:08
0

Possibly basic, but needed some time and help to figure this out.. The problem was in the AWS routing table setup of the third machine. It had a specific rule to allow one machine in, but not the other...

|improve this answer|||||

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.