1

I have an EC2 instance running CoreOS 1068.9.0.

This server is running a very simple Hello World HTTP server.

> curl http://52.43.128.34/
Hello, world!

I have an elastic IP assigned to a network interface on the same subnet. It has public IP address 54.190.35.220 and private IP address 10.8.0.104. Both the instance's security group and the security group on the network interface allow for traffic on TCP port 80 from 0.0.0.0/0.

I add the network interface to the instance. CoreOS logs seem to indicate the new IP was added just fine and it shows up in ifconfig as eth1.

But other computers in the subnet can't access the HTTP server, and it's not accessible externally. The connection fails from both inside and outside the VPC -- other computers can't access it with curl http://10.8.0.104/ and external computers can't access it with curl http://54.190.35.220/.

What gives?

EDIT: More info

  • The server should be listening on all interfaces. Additionally, I see the same behavior from the SSH server, so I don't think it's a problem with the HTTP server itself.
  • Network ACLs are completely open.
  • Security Groups are all open to port 80 and port 22 traffic from 0.0.0.0/0.

  • The subnet's routing table:

    Route Table: rtb-b6449fd1
----------------------------
Destination   | Target
----------------------------
10.8.0.0/16   | local
0.0.0.0/0     | igw-91eb56f5
172.31.0.0/16 | pcx-f6f64e9f
iameli
  • 111
  • 3
  • We can't solve this for you with the information provided. You need to do problem solving, looking at what it's listening to, security groups, network ACLs, routing, etc. – Tim Oct 11 '16 at 21:59
  • Alright, added those things. Next thing I'm going to try are replicating the same steps on an Ubuntu server to try and see if it's a CoreOS specific problem. – iameli Oct 11 '16 at 22:33
  • What is the exact error message when `curl` fails? Can you ping the server? Do the other hosts have ARP entry for the other IP? Check with Wireshark what actually happens on the wire when making the request. – Tero Kilkanen Oct 13 '16 at 22:08

1 Answers1

0

I ended up accomplishing the same thing by assigning multiple IP addresses to the same interface instead of adding multiple interfaces to the same machine. Turns out doing it that first way is a pain with the kernel routing. This blog post set me straight.

iameli
  • 111
  • 3