How to connect to outside world from amazon vpc?

Question

I have amazon VPC set through wizard as "public only network", so all my instances are in public subnet.

Instances within VPC that have Elastic IP assigned connect to internet without any troubles.

But instances without elastic IP can't connect anywhere.

Internet gateway is present. Route table in aws console looks like

Destination Target 
10.0.0.0/16 local
0.0.0.0/0   igw-nnnnn

and route from inside instance shows

Kernel IP routing table
Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
10.0.0.0        *               255.255.255.0   U     0      0        0 eth0
default         10.0.0.1        0.0.0.0         UG    100    0        0 eth0

I tried to open ALL inbound and outbound traffic to 0.0.0.0/0 in security group that an instance belongs to. Still no success.

~$ ping google.com
PING google.com (74.125.224.36) 56(84) bytes of data.
^C
--- google.com ping statistics ---
6 packets transmitted, 0 received, 100% packet loss, time 5017ms

What else can I do?

Flocculus

Answer 1

It appears that the only way to get outside from instances that don't have Elastic IP is:

• Create a NAT Gateway or NAT instance
  • Must be public with an Elastic IP assigned
  • NAT Gateways are a newer solution, are recommended by AWS, and are fully-managed (low maintenance).
  • NAT instances are an older way, are not recommended by AWS, but are available as a self-managed option that gives you full control. You can launch an extra m1.small instance from ami-vpc-nat-beta
• Create an extra subnet which will be "private"
• Move non-EIP-instances to that private subnet
• Modify route tables: 0.0.0.0/0 from the private subnet should go to NAT

So, just adding NAT is not enough. Instances should be stopped and moved to another IP from another subnet.

Flocculus

The docs say that you must also assign an EIP to the NAT instance. – Dimmer

Infact, without assigning EIP to the NAT instance, it WILL NOT WORK. Just tested. – Dimmer

Of course your NAT should have EIP. Implied that. Edited the answer – Flocculus

Don't forget to disable in the NAT instance source/destination check. – Prakash

They must have only recently put in the "NAT instance source/destination check" because I never used to have to disable that before connecting. Pretty silly default setting to not allow outside connections when that's pretty much what most people would be using it for I imagine. – Liberati

Since this is the accepted answer, check your network ACLs too (VPC -> Security -> Network ACLs). Make sure you are not blocking inbound or outbound traffic. In my case, it was failing due to my network ACL not allowing inbound traffic. – Catchascatchcan

Answer 2

The docs tell you should add a NAT Instance

Parke

Answer 3

Q. How do instances without EIPs access the Internet?

Instances without EIPs can access the Internet in one of two ways Instances without EIPs can route their traffic through a NAT instance to access the Internet. These instances use the EIP of the NAT instance to traverse the Internet. The NAT instance allows outbound communication but doesn’t enable machines on the Internet to initiate a connection to the privately addressed machines using NAT, and

http://aws.amazon.com/vpc/faqs/

You can find detailed instructions on how to setup a nat instance here: http://docs.aws.amazon.com/AmazonVPC/latest/UserGuide/VPC_NAT_Instance.html

Snowonthemountain

Answer 4

Or create a NAT Instance within the public VPC and add a static route to that NAT instance

route add -net 0.0.0.0 netmask 0.0.0.0 gw 10.0.0.5 eth0

where 10.0.0.5 is your nat instance, just make sure your the security group which contains the NAT instance can accept internal traffic from the boxes you require internet access

Marvin

I did the same but it messed up the metadata for instances with the static route added. Metadata: docs.aws.amazon.com/AWSEC2/latest/UserGuide/… Public Subnet + EIP and Private Subnet + NAT instance is the way to go. – Injurious

Answer 5

You can do it on any instance in your VPC, that has EIP. There few instructions that i described here should help you. BTW: don't forget disable source/dest. check

Inapprehensible

Yes, there is actually no need to have dedicated NAT instance. Any instance can play this role. – Flocculus

Answer 6

Security Groups -> Outbound

*   ALL Traffic ALL     ALL     0.0.0.0/0   Allow

Please allow Outbound, if you want to connect to external servers like google.com or even want to update- sudo apt-get update

You can allow the outbound using AWS front-end goto Security Groups -> Outbound

Make sure you select the right group for your AWS instance

Halliard

No, the question is about instances without elastic IP. – Flocculus

Answer 7

They have a relatively new product called NAT gateway that does exactly this, creates a managed NAT instance at the edge of your pub/private subnets.

Prelature

Comparison of NAT instances and NAT gateways – Levitate

Answer 8

Instances without EIPs can access the Internet in one of two ways Instances without EIPs can route their traffic through a NAT instance to access the Internet. These instances use the EIP of the NAT instance to traverse the Internet. The NAT instance allows outbound communication but doesn’t enable machines on the Internet to initiate a connection to the privately addressed machines using NAT.

https://docs.aws.amazon.com/vpc/latest/userguide/VPC_NAT_Instance.html

Flit

Answer 9

Did you check the Network ACL on the subnet?

Cross check the security groups for rules.

The route table looks fine. It should work.

Longe

note that the questions is answered 5 months ago. Note that "I tried to open ALL inbound and outbound traffic to 0.0.0.0/0 in security group that an instance belongs to. Still no success." means that it's not connected with security groups. – Flocculus

Answer 10

This works for me with :

• VPC subnet 172.20.0.0/16
• EC2 "nat" gateway 172.20.10.10 with EIP

To do :

• Set disabled source/dest. check on your "nat gw"
• create a new "nat-sub" subnet ex: 172.20.222.0/24
• modify route 0.0.0.0/0 to 172.20.10.10 (my nat gw) for "nat-sub"
• create a EC2 using "nat-sub"
• on your nat gateway as root, try :

root@gw:~# sysctl -q -w net.ipv4.ip_forward=1 net.ipv4.conf.eth0.send_redirects=0

root@gw:~# iptables -t nat -C POSTROUTING -o eth0 -s 172.20.222.0/24 -j MASQUERADE 2> /dev/null || iptables -t nat -A POSTROUTING -o eth0 -s 172.20.222.0/24 -j MASQUERADE

if it works, add this 2 lines in /etc/rc.local

Csch