Join Log in
Score:0
Dimitrios Desyllas avatar Server

Why EC-2 machine is unable to connect into internet if it is behind a Nat Gateway that is associated with a Subnet?

fr flag
Dimitrios Desyllas

I try to implement this network in amazon AWS:

Network

Therefore, I have the following subnets in amazon VPC:

Subnets

The subnet subnet-0ac620105fc198e33 uses a NAT Gateway with an elastic IP having the following route table:

Route table

The nat-0de30b43c561c4161 is my nat gateway.

The others subnets 2 use the default route table: Default route table

And all subnets have the following ACL

enter image description here

The same rules shown above are applied to inbound and outbound traffic.

I also, have 2 EC-2 instances:

  1. That is located in a public subnet used for ssh access in the ones that are in the subnet using the NAT gateway
  2. One inthe subnet using the nat gateway

After having access to the second EC-2 instance, I run the following command:

ping 8.8.8.8
curl http://google.com

But fails to connect into google. Why I am unable to connect?

54
0 + 0
Score:0
Dimitrios Desyllas avatar Server
fr flag
Dimitrios Desyllas

Summary: the NAT gateway must be in a public subnet, and it must have a route to an internet gateway. AWS documentation covers this here and here.

Look that nat gateway is in a subnet that is accessed through a normal internet gateway in your case both Host1 and Nat Gateway can be in the same subnet or in a subnet that forwards the traffic through a normal internet gateway.

In a simple image what you must achieve is the following:

How network should be

So consider Nat Gateway as another host that forwards traffic to a subnet that has internet gateway. The diagram above shows how each machine should be connected to internet. In your case Host 2 accesses Subnet 2 and through Nat Gatewaty and subnet 1 via a normal Internet gateway accesses the Internet.

In your case, either the subnets subnet-0c8192051e2a46965 or subnet-065ae3de09e9f8355 are suitable to host the Nat Gateway. But Nat Gateway must NOT be in the subnet subnet-0ac620105fc198e33

In order to change the subnet of the Nat Gateway you must create a new one Nat Gateway afterwards update the route table to utilize the Nat gateway. If you want to keep the Elastic IP wait for the old Nat Gateway to be deleted. Afterwards, use the new one.

And remember once you are creating the new Nat Gateway in this field as shown bellow:

enter image description here

Select either the subnets subnet-0c8192051e2a46965 or subnet-065ae3de09e9f8355.

0 + 0
Tim avatar
gp flag
Tim
Your question and answer are somewhat confusing. Is your conclusion basically "the NAT gateway must be in a public subnet"?
0
Reply
Dimitrios Desyllas avatar
fr flag
Dimitrios Desyllas
Yes Nat gateways must be in a public subnet.
0
Reply
Tim avatar
gp flag
Tim
I've added a summary at the top of your answer. Your diagrams might be easier for people to understand if you show instances / gateways inside subnets rather than pointing to them, as that is a more standard way they're drawn. I suggest you label your subnets public / private as well.
0
Reply
Dimitrios Desyllas avatar
fr flag
Dimitrios Desyllas
Well AWS has one but I had hard time to understand them. I find rather easier to place paths towards internet.
0
Reply
Tim avatar
gp flag
Tim
You might benefit from doing the AWS associate architect training. AWS is a complex enterprise system, people generally need training to understand it.
0
Reply
ธงชาติไทย
Elon Musk
I sit in a Tesla and translated this thread with Ai:

mangohost

Post an answer

Most people don’t grasp that asking a lot of questions unlocks learning and improves interpersonal bonding. In Alison’s studies, for example, though people could accurately recall how many questions had been asked in their conversations, they didn’t intuit the link between questions and liking. Across four studies, in which participants were engaged in conversations themselves or read transcripts of others’ conversations, people tended not to realize that question asking would influence—or had influenced—the level of amity between the conversationalists.