45

Important updates: In October, 2018, AWS expanded the capabilities of the network technology underpinning EFS so that it now natively works across managed VPN connections and cross-region VPC peering, without resorting to the proxy workaround detailed below. https://aws.amazon.com/about-aws/whats-new/2018/10/amazon-efs-now-supports-aws-vpn-and-inter-region-...


42

I would recommend the following considerations: If you creating an IPSEC connection between your corporate LAN and your VPC, use a CIDR that is different than that on your corporate LAN. This will prevent routing overlaps and create an identity distinction for reference. For very large networks, use at least different 16-bit masks in different regions eg ...


41

The main difference is the route for 0.0.0.0/0 in the associated route table. A private subnet sets that route to a NAT instance. Private subnet instances only need a private ip and internet traffic is routed through the NAT in the public subnet. You could also have no route to 0.0.0.0/0 to make it a truly private subnet with no internet access in or out. ...


33

You can set up a bastion host to connect to any instance within your VPC: http://blogs.aws.amazon.com/security/post/Tx3N8GFK85UN1G6/Securely-connect-to-Linux-instances-running-in-a-private-Amazon-VPC You can choose to launch a new instance that will function as a bastion host, or use your existing NAT instance as a bastion. If you create a new instance, ...


33

In the EC2 console, in the navigation pane on the left, click Network Interfaces. Everything with an IP address -- EC2 instances, ELBs, NAT Gateways, RDS instances (to name some of the more common ones) has at least one virtual NIC called an Elastic Network Interface (ENI). Each ENI typically has a primary private IPv4 address and may have one or more ...


29

With a username like "The Internet", I'd expect you to know this. But since you asked... :) VPC's are truly private. Only traffic that you explicitly allow can transit the borders of the VPC. So, inside a VPC, instances needing access to external resources either need to be assigned an EIP (in which case they can access external resources using AWS's ...


26

No they are not the same. Internet Gateway Routes traffic from instances with Public IPs to the Internet. It simply forwards traffic between Public IPs in your VPC and Public IPs in the internet back and forth, mostly unchanged. Gateways can sometimes be called routers but AWS doesn't use this term. NAT Gateway Routes traffic from instances with only ...


23

For an RDS instance in VPC to "publicly" (Internet) accessible, all of the subnets it is attached to must be "public" -- as opposed to "private" -- subnets of the VPC. A public subnet is essentially defined as a subnet that has the Internet Gateway object (igw-xxxxxxxx) as its route to "the Internet," or at least to any Internet destinations you need to ...


22

You need a NAT. This configuration is commonly used to support private subnets in VPC, there's quite a detailed guide here. Once your VPC is configured to use the NAT instance all the outbound traffic will be attributed to the EIP of the NAT instance. If so, does that instance need to be solely for this purpose or can it be one of the instances that's ...


18

Did you create a Cache Subnet Group in you custom VPC? You need to create a cache subnet in your VPC (inside the ElastiCache Management) first - after that your VPC/Subnet will appear for nodes.


16

Unfortunately AWS has been severely neglecting meaningful IPv6 support. Their "solution", if you can call it that, is to throw a non-VPC ELB in front of your application. For many reasons that is a non-tenable solution for many use cases. As a stopgap fix, the tactic I've seen used by several organizations is to stand up an IPv6-capable VPS with another ...


14

I understand this is an old thread - for someone who has a similar use-case now, AWS nat-gateway would be a better solution.


14

I guess the straightfwd way is to actually probe those routes. You can traceroute to s3 and see if the NAT Gateway's internal IP is anywhere in the output (eg. the first hop). First, check the NAT Gateway internal IPs in the console. Example output with the endpoint set - no gateway IP shown. This is what you want to see. $ traceroute -n -T -p 443 s3....


14

You seem to be laboring under some misunderstandings about network fundamentals in VPC. set up a nat gateway for each private subnet in each availability zone. For all practical purposes, this is never something you would actually need to do. The maxiumum number of NAT Gateways you would ever need in a single VPC would be 1 per AZ. NAT Gateways are ...


13

From within the machine netstat -ntlp / netstat -nulp will show all open TCP / UDP ports (and associated programs) respectively. From external, nmap -sT and nmap -sU will show open TCP/UDP ports respectively. Keep in mind that these commands might require root privileges and also make sure to whitelist the source of the scans in the firewall - or else you ...


13

Apparently, you don't actually get to choose which VPC Lightsail will try to peer with -- it wants to peer with your Default VPC. Once VPC peering is enabled, you can address other AWS resources in your default AWS VPC by using their private IPs. https://amazonlightsail.com/docs/#faq I don't know if I overlooked this originally, or if it was ...


13

A NAT Gateway (as well as a NAT Instance, for what it's worth) must be in a public subnet because only devices on public subnets can actually use a public IP address. That's what makes a public subnet a public subnet. The pedantic definition of a public subnet is a subnet whose associated VPC route table has at least one route pointing to the Internet ...


13

You can use CloudFormer to export your existing AWS infrastructure into CloudFormation template. Alternatively you can use terraforming ruby gem to export your infrastructure as Terraform files.


12

"Your" Cloudfront distribution is not a single thing at a single place. It's a virtual entity on a global distributed network, and the more places from which it is being accessed, the more potential IP addresses you may see, because the requests are routed to the requester's nearest endpoint, using DNS. If I access your distribution, that's going to ...


12

In my case, executing the following successfully started the openvpn connection without losing ssh functionality: Example sudo route add -host 96.113.49.112 gw 10.0.0.1 openvpn --config newvpnconfigfile1.ovpn where the ip following host is our office network's public IP (you can get this by just typing "what's my ip" into Google on your own pc) and the ip ...


12

Currently, Elasticache does not provide authentication mechanisms like, for example, RDS does. The only security available is SecurityGroups, limiting network traffic from specific sources. Should you require Redis authentication, you will have to deploy Redis on top of EC2 instances and manage it by yourself.


12

The best start is to refer to VPC and Subnet Basics which explains the VPC addressing and sizing reqirements. Not sure if you are familiar with CIDR addressing? Essentially the bigger the number after / the less hosts and subnets you can fit inside such network. For example: Your VPC CIDR is 172.22.130.0/28 where /28 means that out of the 32 bits in the IP ...


11

The routing table by default will only route traffic to eth0. Even though ubuntu detects the other ENI, you still have to route traffic to it. You'll have to do some advanced routing: 1) Enabling access to 2nd ENI immediately and temporarily. source: http://www.rjsystems.nl/en/2100-adv-routing.php # this will show your route table, i'll assume you have ...


11

Security groups won't be visible, because VPC security groups have no meaning outide their VPC... and your Classic instance is (of course) outside the VPC. Private VPC IP addresses of the instances won't work in the security config, either, since they also have no meaning outside the VPC. The solution is that you have to open up access (in the RDS security ...


11

Not quite sure the answer flagged as correct is actually correct. Every Amazon account now has a default VPC (this wasn't always the case) which has an Internet Gateway, an RFC 1918 subnet and a Default route table which routes all non-local traffic to the Internet. Depending on which VPC you are operating in, deployed instances will or will not have a ...


11

Turns out EC2 was blocking the forwarded packets from the OpenVPN server. There is a setting on the EC2 Dashboard under Network & Security -> Network Interfaces -> Actions -> Change Source/Dest. Check. When I disabled this on all my instances traffic through the VPN is flowing as intended. Hopefully this will help someone else.


11

The arrows in the diagram only indicate the direction of connection establishment -- not traffic flow. Yes, return traffic goes back through the ELB. But, it isn't a stateful NAT -- it's a TCP connection proxy. The ELB machines accept TCP connections on the configured listening ports, terminating the SSL session if so configured, and establish a new TCP ...


11

I have found a method to verify the VPC endpoint usage. Log in to an AWS EC2 instance in the VPC Configure the aws cli client run aws ec2 describe-prefix-lists; for Windows PowerShell, Get-EC2PrefixList The result should contain the the VPC endpoints prefix list ID in the attribute PrefixListId. For additional verification, you can apply the following ...


11

You can turn on S3 logging and check if the files are being accessed from your private IP rather than public. If your logging shows private IPs are accessing the buckets you've configured it correctly. Goodluck!


11

This is expected. Lambda functions in a VPC can't communicate with the Internet (including the standard service APIs) using an Internet Gateway, because an Internet Gateway requires the internal devices to have associated public IP addresses. Being on a public subnet (where the default route is the Internet Gateway) isn't sufficient. Important If ...


Only top voted, non community-wiki answers of a minimum length are eligible