1

I have this EC2 instance with private IP 172.31.11.204 and public IP 34.205.X.X My web service is running on private IP 172.31.11.204 and on port 31336.

  1. Inside EC2, I am able to access the service using curl 172.31.11.204:31336
  2. From my computer, I'm able to access it using ec2 public IP and port 31336 curl 34.205.X.X:31336

But I am unable to access the service using port 80 i.e., curl 34.205.26.X:80

My Security group rule is perfectly fine.

Also, I tried with adding the with follwing nat rule in IPtables -

sudo iptables -t nat -A PREROUTING -p tcp --dport 80 -j DNAT --to-destination 172.31.11.204:31336

OR

sudo iptables -t nat -I PREROUTING --src 0/0 --dst 127.0.0.1 -p tcp --dport 80 -j REDIRECT --to-ports 31336

when I do tcpdump, I noticed the incoming connection is getting hit onto the above rule but the return traffic is stuck at 172.31.11.204.80

I have searched a lot but could not find any solution.

1

Two options:

  1. Why don’t you make your app listen on port 80 and be done with it? Since you want to redirect all traffic to it it won’t be any less secure.

  2. You may need to open port 80 in your INPUT chain:

    iptables -I INPUT -p tcp --dport 80 -j ACCEPT
    

    And then the redirect rule without the addresses:

    iptables -t nat -I PREROUTING -p tcp --dport 80 -j REDIRECT --to-ports 31336
    

    Maybe --to-ports 127.0.0.1:31336, not sure.

    Also try setting sysctl -w net.ipv4.conf.eth0.route_localnet=1 - that may be needed.

However if I were you I would simply make the app listen on port 80 ;)


Update: you should have mentioned the container listening on 31336 is managed by Kubernetes! In that case what you need is a Service that will accept the external connections and forward them to the Pod.

Have a look here for more details: https://kubernetes.io/docs/concepts/services-networking/service/

Hope that helps!

  • No It does not work. – tanmoy Dec 10 '18 at 10:58
  • Even after using in combination of above iptable rules..I tried that before also. Only this time enabled the /proc/sys/net/ipv4/conf/eth0/route_localnet , as per your suggestion. Below is the traceroute - To answer your question, I am running my nginx app as a pod deployment and exposed services as NodePort 31336 . The port is selected automatically and I dont think I am having control on choosing that. My all purpose is to get this service accessible from outside via http port 80. – tanmoy Dec 10 '18 at 11:06
  • Is there any other way I can avail this service from privateIP:31336 to ec2 public IP such as using ha-proxy, ingree controller or AWS Load-balancer? – tanmoy Dec 10 '18 at 11:11
  • @tanmoy Updated my answer to include info about K8s Services - that's what you need. – MLu Dec 10 '18 at 23:40

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.