4

I have created a new EC2 instance using terraform for installing vertica, but not able to access Internet or ping google.com within the instance.

I have set up an ec2 instance with a private subnet and have set up nat gateway with a public subnet.

The main route table allows 0.0.0.0/0 as destination and target as the nat gateway.The other route table has the subnet association as the private subnet 10.103.2.0/24. The internet gateway is also attached to the vpc.

My security group for the ec2 instance allows traffic for Redshift and ssh for the following destinations: 10.83.0.0/16,10.100.0.0/16 and outbound all traffic: 10.83.0.0/16,10.100.0.0/16

My Questions:

  1. Should any route table have internet gateway as the target?
  2. Should the security group also allow icmp?
  3. Please brief me how I should troubleshoot and what I should check?
Software Engineer
  • 15,457
  • 7
  • 74
  • 102
user6826691
  • 1,813
  • 9
  • 37
  • 74

3 Answers3

2

This statement

The ec2 instance has private subnet

contradicts this statement

I have the internet gateway set up for the route table too

If you have a subnet that has has a route to the internet gateway, you have a public subnet. Your instance will have internet access if all of this requirements are fulfilled:

  1. The EC2 instance has a public IP address.
  2. Network ACL allows inbound and outbound traffic on required ports. Network ACL is like a stateless firewall. It's not enough to allow only outgoing connections.
  3. Your security group should allow outgoing traffic on required ports.

If your instance doesn't have a public IP address, you will need to deploy NAT gateway.

Sergey Kovalev
  • 9,110
  • 2
  • 28
  • 32
  • 2
    i am using NAT Gateway and the ec2 instance is set up with private subnet – user6826691 Dec 29 '16 at 19:27
  • For me, my ACLs were badly configured which led my EC2 to not have internet access (HTTP and HTTPS at least). This answer and the following official doc with an ACL example helped me out : https://docs.aws.amazon.com/vpc/latest/userguide/vpc-network-acls.html – Zgore Mar 27 '23 at 15:50
1

Most likely you haven't defined any internet gateways for your VPC

jdevelop
  • 12,176
  • 10
  • 56
  • 112
-2

Based on your responses to the other answers, disabling source/destination check should resolve your issue.

https://docs.aws.amazon.com/vpc/latest/userguide/VPC_NAT_Instance.html#EIP_Disable_SrcDestCheck

tuxlin
  • 1
  • 2