Question

I have created a new EC2 instance using terraform for installing vertica, but not able to access Internet or ping google.com within the instance. 

I have set up an ec2 instance with a private subnet and have set up nat gateway with a public subnet.

The main route table allows 0.0.0.0/0 as destination and target as the nat gateway.The other route table has the subnet association as the private subnet 10.103.2.0/24. The internet gateway is also attached to the vpc.


My security group for the ec2 instance allows traffic for Redshift and ssh for the following destinations: 10.83.0.0/16,10.100.0.0/16 and outbound all traffic: 10.83.0.0/16,10.100.0.0/16

我的问题：
1.任何路由表是否应以互联网网关作为目标？ 2.安全组是否也允许icmp？ 3.请告诉我应该如何解决问题以及应该检查什么？

Answer 1

您很可能没有为您的VPC定义任何internet gateways

Answer 2

本声明

ec2实例具有私有子网

与此陈述相矛盾

我也为路由表设置了互联网网关

如果您的子网有到Internet网关的路由，则您有一个公共子网。如果满足所有这些要求，您的实例将可以访问Internet：

EC2实例具有公共IP地址。
网络ACL允许所需端口上的入站和出站流量。网络ACL就像无状态防火墙。仅仅允许传出连接是不够的。
您的安全组应允许在所需端口上传出流量。

如果您的实例没有公共 IP地址，则需要部署NAT网关。

Answer 3

根据您对其他答案的回答，禁用源/目标检查应该可以解决您的问题。

https://docs.aws.amazon.com/vpc/latest/userguide/VPC_NAT_Instance.html#EIP_Disable_SrcDestCheck

EC2实例无法访问Internet

3 个答案: