3

I enabled packet forwarding between two nodes, A(172.31.17.22) and B(172.31.16.9) but packets are not being forwarded, and tcpdump on node B is not showing any traffic not destined for itself: ping 172.31.16.9 -c 1 (direct from A to B)

Tcpdump ( tcpdump -e icmp -I eth0) on A:

0e:34:43:04:5c:8c (oui Unknown) > 0e:b8:b3:ed:48:10 (oui Unknown), ethertype IPv4 (0x0800), length 98: ip-172-31-17-22.ec2.internal > ip-172-31-16-9.ec2.internal: ICMP echo request, id 28945, seq 1, length 64

0e:b8:b3:ed:48:10 (oui Unknown) > 0e:34:43:04:5c:8c (oui Unknown), ethertype IPv4 (0x0800), length 98: ip-172-31-16-9.ec2.internal > ip-172-31-17-22.ec2.internal: ICMP echo reply, id 28945, seq 1, length 64

On B:

0e:34:43:04:5c:8c (oui Unknown) > 0e:b8:b3:ed:48:10 (oui Unknown), ethertype IPv4 (0x0800), length 98: ip-172-31-17-22.ec2.internal > ip-172-31-16-9.ec2.internal: ICMP echo request, id 28945, seq 1, length 64

0e:b8:b3:ed:48:10 (oui Unknown) > 0e:34:43:04:5c:8c (oui Unknown), ethertype IPv4 (0x0800), length 98: ip-172-31-16-9.ec2.internal > ip-172-31-17-22.ec2.internal: ICMP echo reply, id 28945, seq 1, length 64

Now, if I would like to forward a packet from A, through B, to C, I would set a route on A so that packets destined for C were sent first to B. So, I set a route on A, where C=15.15.15.15. And then attempt to ping:

sudo ip route add 15.15.15.15/32 via 192.168.7.234
Ping 15.15.15.15 -c 1

Tcpdump on A:

0e:34:43:04:5c:8c (oui Unknown) > 0e:b8:b3:ed:48:10 (oui Unknown), ethertype IPv4 (0x0800), length 98: ip-172-31-17-22.ec2.internal > 15.15.15.15: ICMP echo request, id 28970, seq 1, length 64

On B, we see nothing. Which is really odd, because we can see from tcpdump that the ethernet addresses are exactly the same. Furthermore, I ran this test with two other linux nodes on my own network, and can see that from B, we should expect something like this:

… IPv4 (0x0800), length 98: 192.168.7.173 > 15.15.15.15: ICMP echo request, id 17443, seq 1, length 64 … IPv4 (0x0800), length 118: 192.168.7.254 > 192.168.7.154: ICMP 192.168.7.254 udp port ntp unreachable, length 84

on AWS, I have a rule that allows ICMP connections from anywhere… furthermore, I have set/etc/sysctl.conf on both nodes:

net.ipv4.ip_forward = 1
net.ipv4.conf.all.accept_redirects = 0
net.ipv4.conf.all.send_redirects = 0

I flushed my iptables rules(on both nodes) so that forwarding would be allowed:

[root@ip-172-31-16-9 ec2-user]# iptables -L

Chain INPUT (policy ACCEPT) target prot opt source
destination

Chain FORWARD (policy ACCEPT) target prot opt source
destination

Chain OUTPUT (policy ACCEPT) target prot opt source
destination

So, my results are that on my LAN it works, on AWS EC2 it doesn't ... so does EC2 block ip forwarding?

  • 2
    Have you turned off Source/Dest. Checking? – kenlukas Sep 14 '18 at 20:50
  • @kenlukas Wow. I had no idea that existed. That is literally the one thing that it could have been and that was it! Thank you very much! – Code Wiget Sep 14 '18 at 21:12
  • Cool, posting it as an answer. – kenlukas Sep 14 '18 at 22:10
6

Each EC2 instance performs source/destination checks by default. This means that the instance must be the source or destination of any traffic it sends or receives. However, a NAT instance must be able to send and receive traffic when the source or destination is not itself. Therefore, you must disable source/destination checks on the NAT instance. https://docs.aws.amazon.com/vpc/latest/userguide/VPC_NAT_Instance.html#EIP_Disable_SrcDestCheck

To disable source/destination checks from the AWS CLI:

aws ec2 modify-instance-attribute --instance-id <instance_id> \
--no-source-dest-check

To disable source/destination checks from the EC2 service console highlight the instance you want to disable the check on.
Then select:

  1. Actions
  2. Networking
  3. Change Source/Dest. Check

enter image description here

On the pop-up select Yes, Disable

enter image description here

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.