0

I am encountering an issue where I am unable to receive a response when attempting to ping from a namespace located within a public EC2 instance to a private one. To better illustrate my situation, I have included a diagram below.

Structure

Update:

Private Subnet: Private Subnet

Public Subnet: Public Subnet

Private Route: Private Route

Public Route: Public Route

NAT: NAT Inbound NAT Outbound

Tanvir Rahman
  • 101
  • 2
  • Thanks for including so much information! Are you talking about Linux namespaces? If so you might like to use basic Amazon Linux 2 instances in the same subnets / SGs that your current instances are in, for debugging. The issue is likely 1) security groups 2) NACLs 3) routing. Can you please edit your question to include screenshots of the incoming and outgoing security groups for each instance, routing for each subnet that has an instance, and NACLs. – Tim Jan 31 '23 at 05:46
  • I have added additional info you requested @Tim – Tanvir Rahman Jan 31 '23 at 09:31
  • Do the instances share the same security group? If so I would add an explicit self-referential security group rule incoming and outgoing. i.e. when you edit the SG under incoming / outgoing start typing the security group name, and ensure it allows all traffic. During testing use "ping -4" or similar to force IPv4 pings. Routing is my next thought, it would be easier to see the console. As a test, route direct to the IGW rather than via the NAT gateway, I can't see a valid route since NAT GW won't allow incoming pings. Also consider using VPC Flow Logs to trace the packets. – Tim Jan 31 '23 at 18:19
  • The main issue was, i was doing ping in 172.16.1.10 which is a private ip (Attached screenshot). Now when i am doing ping in ec2 host ip from namespace1, the ping is reaching until bridge2. Trying to figure out how to forward the ping to namespace2. @Tim – Tanvir Rahman Feb 01 '23 at 06:19
  • 1
    You've lost me with the namespace stuff, you'll need to tag for Linux rather than AWS. I can help with AWS no problem, which is why I suggested Amazon Linux 2 tests, once that works you can try to get namespaces working. Interesting to note, each network interface associated with an instance has a private IP, the public IP is a form of NAT at the internet gateway, so internal traffic should always use IPs. – Tim Feb 01 '23 at 06:38

0 Answers0