0

I have a setup with a couple of services running in ECS (separate frontends and backends). And now I have the requirement that outbound requests from the backends to some third part APIs needs to have an static (elastic) IP.

As I'm quite the novice with networking I've been following this guide, for basically routing requests to given IP-addresses through the NAT.

Setup:

  • One VPC
  • 3 subnets (2 for ECS services, the third for the NAT) - All public(?)
  • Application load balancers for the services.
  • Routing to the load balancers through Route53.

The way I've been testing it is to either route all traffic, or traffic to my local IP, in the main routing table through the NAT gateway instead of the internet gateway directly. And in both cases, when I try to access either a frontend or server it never responds. And I don't see any traffic in the monitoring-tab for the NAT either. If I just route the traffic directly to the IGW from the main routing table it obviously still work.

So I'd really appreciate some help here since I'm not sure if it's my setup that's not compatible with the above solution, I'm doing something wrong of just overlooking something.

Edit: Did the sensible thing, as pointed out, and placed the services in private subnets.

Terris
  • 25
  • 8

1 Answers1

1

If you have all your ECS tasks in the public subnet, how are you going to mask all of them behind the NAT? Even my cat knows this.

EvilDeveloper
  • 21
  • 2
  • Obviously not. As I said, I'm a novice when it comes to this. When I tried solving the issue with having static IP for outgoing network traffic (for those third party APIs), this is what I found. Like [this](https://stackoverflow.com/a/57678560/4102226) (or similar answers). – Terris Jan 26 '22 at 11:09
  • 2
    His solution is not gonna work if the external APIs are changing IPs which is highly likely because of CDNs and Distributed Architectures. Put your workloads on private subnets and your problem is over. Stop banging heads with the wall :D – EvilDeveloper Jan 26 '22 at 11:12