1

I'm trying to setup an EC2 instance as NAT gateway of sorts that other instances in a private network will be routed to.

I have a following setup:

VPC

  • 10.0.0.0/16

2 subnets

  • A: 10.0.1.0/24
  • B: 10.0.2.0/24

2 EC2 instances

  • NAT instance with 2 network interfaces eth0, eth1, both in subnet A
  • Another instance in subnet B

In the NAT instance, eth0 is meant for public network and eth1 for private and they have firewalls set accordingly.

I tried to create route table for subnet B that routes the default to eth1 of NAT, i.e.:

0.0.0.0/0 <id of eth1 on NAT>

Then I tried to run tshark -i eth1 (Wireshark in command line) on NAT to see if any traffic is getting there and I ran ping google.com on the other instance. With no success. I also tried curl google.com just in case pings are blocked somewhere, but also nothing happened.

Looks like there is something wrong with the way AWS is routing the traffic so it never reaches the network interface even though the route table is set that way.

I'd appreciate if someone can help me with this. Thank you.

DISCLAIMER: I know that AWS has a built-in NAT gateway option and it's not suitable for my case.

Improve this question

1 Answer 1

Reset to default
2

As neither the source nor the destination of the packets are an IP address that belongs to your NAT gateway of sorts, you need to disable the srcdst check on the Network Interfaces you'd like to handle traffic (I'd say both in the NAT gateway):

https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/using-eni.html#change_source_dest_check

Otherwise the platform drops the traffic as an "antispoofing" protection so to speak.

If you want to do this in Azure, the equivalent is the IP Forwarding flag.

Improve this answer
1
  • omg I read all the relevant docs but never would I think of something like this. Thank you so much!! It works! Commented Mar 6, 2019 at 10:26

You must log in to answer this question.

Start asking to get answers

Find the answer to your question by asking.

Ask question

Explore related questions

See similar questions with these tags.