0

My AWS development has the following architecture.

1 VPC having 2 Private Subnets: 1 for RDS (10.0.11.0/24), 1 for EC2(10.0.1.0/24) 1 Public Subnet:

1 Internet Gateway attached to my VPC

3 Route Table:

a) Main Route Table (0.0.0.0/0 target Internet Gateway)

b) EC2 Route Table (Associated with EC2 Private Subnet) plus additional route 0.0.0.0/0 targeted to Network ID interface of NAT instance

c) RDS Route Table (Associated with RDS Private Subnet)

3 Security Groups:

a) EC2 (Incoming as selected and Outgoing allowed All)

b) RDS (Incoming as selected and Outgoing allowed All)

c) NAT (Incoming as selected and Outgoing allowed All)

iptable prerouting rules have been added in NAT instance to redirect data to EC2 instance ports. Incoming data is fine as per the rules. SSH and other opened ports are working.

Problem is all outgoing network calls from my EC2 instance are blocked. I can not even perform commands like "apt-get update" or clone repo from github. They get timed out. Also, my server code can not reach AWS S3 resources. Connection to RDS is working fine.

Earlier it was working fine for last few months. Yesterday, I was installing nginx and played with ufw and that is when I noticed the issue and I thought I messed up iptables and thus purged ufw package and flushed iptable rules, rebooted. Still it did not help.

I launched another EC2 instance with the same subnet and other rules, just to see if the issue is with the earlier EC2 instance. Even the new instance is not able to reach external websites. No idea how to investigate further.

UPDATE: Just for completeness posting iptable of my EC2

ubuntu@ip-10-0-1-126:~$ sudo iptables -S

-P INPUT ACCEPT

-P FORWARD ACCEPT

-P OUTPUT ACCEPT

0

Do you attach public IP to your EC2?

EC2 in public subnet need public IP to be connected to internet. If you create EC2 in private subnet with NAT gateway, it doesn't need public IP.

  • My NAT instance is in Public Subnet and yes it can access internet as well as receive incoming requests. It is also able forward my requests on particular ports to my Private subnet EC2 instance and that is how I am able to SSH into those private subnet EC2 instance. I am not sure what happened, everything was working fine for last few months and suddenly outgoing requests from my Private Subnet EC2 stopped going out. I thought I messed up during nginx installation and working with ufw/iptable but even a new EC2 instance launched from scratch is behaving same. Can not seem to pin point problem – Debasish Mitra Mar 2 '19 at 12:26
0

The NAT PREROUTING iptable rules were OK for incoming. For outgoing traffic. I needed to add POSTROUTING rules. Surprisingly I did not find it mentioned in any tutorial and more surprising till now my instances worked fine for outgoing traffic.

For more details I suggest you to visit this post https://medium.com/@rakeshkanagaraj1990/aws-nat-instance-bb0911ba19d5

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.