0

I have two VPC (VPC1, VPC2) in different regions. Each VPC has two EC2 instances. On VPC1, I have a public and a private subnets (subnet1 and subnet2 respectively) each with its own routing table, and on VPC2, I have one private subnet (subnet3). Also, I have enabled VPC Peering between my two VPCs over the private subnets.

I have also added an internet and NAT gateways to VPC1 to be able to reach the internet.

On VPC1, I launched two EC2 instances, client instance which runs on the private subnet, and a public_ec2_subnet1 which runs on the public subnet. On VPC2, I have two EC2 instances, server2 which runs on the private subnet (subnet3) on VPC2, and server1 which runs on a public subnet on the default VPC of the region, NOT ON THE SAME VPC

On the client's EC2 instance, I added a java file called EchoClient.java which takes an IP address as an argument, and on both server1 and server2 I added another java file called EchoServer.java which runs on port 10008 on whichever instance it is on.

EchoClient.java:

import java.io.*;
import java.net.*;

public class EchoClient {
    public static void main(String[] args) throws IOException {

        String serverHostname = new String ("127.0.0.1");

        if (args.length > 0)
           serverHostname = args[0];
        System.out.println ("Attemping to connect to host " +
        serverHostname + " on port 10008.");

        Socket echoSocket = null;
        PrintWriter out = null;
        BufferedReader in = null;

        try {
            // echoSocket = new Socket("taranis", 7);
            echoSocket = new Socket(serverHostname, 10008);
            out = new PrintWriter(echoSocket.getOutputStream(), true);
            in = new BufferedReader(new InputStreamReader(echoSocket.getInputStream()));
        } catch (UnknownHostException e) {
            System.err.println("Don't know about host: " + serverHostname);
            System.exit(1);
        } catch (IOException e) {
            System.err.println("Couldn't get I/O for " + "the connection to: " + serverHostname);
            System.exit(1);
        }

        BufferedReader stdIn = new BufferedReader(new InputStreamReader(System.in));
        String userInput;

        System.out.print ("input: ");
        while ((userInput = stdIn.readLine()) != null) {
            out.println(userInput);
            System.out.println("echo: " + in.readLine());
            System.out.print ("input: ");
        }

        out.close();
        in.close();
        stdIn.close();
        echoSocket.close();
    }
}

EchoServer.java:

import java.net.*; 
import java.io.*; 

public class EchoServer 
{ 
 public static void main(String[] args) throws IOException 
   { 
    ServerSocket serverSocket = null; 

    try { 
         serverSocket = new ServerSocket(10008); 
    }catch (IOException e){ 
         System.err.println("Could not listen on port: 10008."); 
         System.exit(1); 
    } 

    Socket clientSocket = null; 
    System.out.println ("Waiting for connection.....");

    try { 
         clientSocket = serverSocket.accept(); 
    }catch (IOException e){ 
         System.err.println("Accept failed."); 
         System.exit(1); 
    } 

    System.out.println ("Connection successful");
    System.out.println ("Waiting for input.....");

    PrintWriter out = new PrintWriter(clientSocket.getOutputStream(),true); 
    BufferedReader in = new BufferedReader(new InputStreamReader(clientSocket.getInputStream())); 

    String inputLine; 

    while ((inputLine = in.readLine()) != null){ 
         System.out.println ("Server: " + inputLine); 
         out.println(inputLine); 

         if (inputLine.startsWith("Bye.")) break; 
    } 

    out.close(); 
    in.close(); 
    clientSocket.close(); 
    serverSocket.close(); 
   } 
} 

Here is the process I do to run the code on the instances:

  • The first terminal I SSH into server1 and run the server java code and it waits for a connection
  • The I use the public_ec2_subnet1 instance to SSH into the client instance and run the EchoClient.java code with the public IP address of server1; however, the connection always returns a timeout
  • I stop server1, and open another terminal and SSH into public_ec2_subnet1 instance to SSH into the client instance and then I SSH into Server2 since it is on a private subnet and run the server code
  • I run the client's code using Server2's private IP since VPC peering is connected and subnet3 is private, but that also gives me a timeout response.

I Added 0.0.0.0/0 and ::/0 to the inbound and outbound rules for SSH (TCP), HTTP (TCP), HTTPS (TCP) for Server1 instance, and I added it only for SSH (TCP) for client, server2 instances.

When I try to use AWS Console to view server1 (public) on the browser, it gives me a connection refused.

I did some research and all the solution I found were to add the inbound and outbound rules. I am not sure why the client and either of the server's aren't able to communicate.

Would someone please shed some light into this matter? Let me know if you need more information.

Update_1

Subnet1 NACL rule:

enter image description here

Subnet2 NACL rule:

enter image description here

Subnet3 NACL rule:

enter image description here

Default Subnet on VPC2 NACL rule:

enter image description here

Hussam Ahmed
  • 413
  • 1
  • 5
  • 17
  • How did you setup route tables for the peering connection? – Marcin Apr 08 '21 at 00:10
  • What happens if you add 0.0.0.0/0 and ::/0 inbound rules for the private instance's security group, for all protocols, and then try to ping it using its private IP address? Also, what are the NACL rules for each subnet? Those may be blocking the connection as well. – James Shapiro Apr 08 '21 at 00:40
  • @JamesShapiro pinging doesn't work be default; how ever I added a rule for ICMP and it worked. I updated the post with screenshots of my NACL rules – Hussam Ahmed Apr 08 '21 at 01:34
  • @Marcin I associated the private CIDR blocks to the peering connection `pcx-` I can ssh from my client on VPC1 to the servers on VPC2 since both are peered – Hussam Ahmed Apr 08 '21 at 01:38
  • Could be app-level issue. maybe the app is using public IPs or URLs to connect to the servers, not private IPs? – Marcin Apr 08 '21 at 01:45
  • @Marcin it is subnet dependent. Meaning if a subnet is public it would use public IPs. Do you know of a way to double check? – Hussam Ahmed Apr 08 '21 at 01:56
  • You check in your code. How do you refer to your servers? – Marcin Apr 08 '21 at 02:04

0 Answers0