By using AWS re:Post, you agree to the AWS re:Post Terms of Use
AWS re:Postre:Post

Internet GW routing for internal traffic

0

Please consider two EC2s, A & B.

When I ping/telnet (consider SGs allow this) from A to B with private IPs, IGW doesn't participate, traffic gets sent from private IP as a SRC address of A to the private IP of B (similar to same subnet/VLAN concepts we know from traditional networking).

When I ping the EIP of B, I see traffic originating with the EIP of A as the SRC address, which gets sent to IGW, IGW sees the private IP of A, reroutes it internally (hair pinning?) and delivers to the private IP of B. So, the traffic never leaves the VPC boundary.

I cannot find concrete docs/ links for such a case, are my above observations correct?

Topics
Networking & Content Delivery
Tags
Amazon VPCNetwork Security
Language
English
Junaid Shahid
asked 21 days ago64 views
1 Answer
2
Accepted Answer

You are correct as the Routing Table for the Subnet has the VPC CIDR as Local.

0.0.0.0/0 default routes to IGW from public Subnet

profile picture
EXPERT
Gary Mclean
answered 21 days ago
profile picture
EXPERT
Oleksii Bebych
reviewed 3 days ago
profile picture
EXPERT
Adeleke Adebowale J
reviewed 21 days ago
profile picture
EXPERT
Riku_Kobayashi
reviewed 21 days ago
  • Junaid Shahid
    21 days ago

    Thanks. If I ping using the private IP, I don't need any rules in the SG (the self-referencing rule is enough), but when I ping B's EIP, traffic must go through IGW (where A's EIP gets mapped to its private IP), so as the traffic appears to be arriving from A's EIP, I do need to whitelist A's EIP in the SG. Looks unnecessary at first but if we look closely that's the right approach!

  • Gary Mclean EXPERT
    21 days ago

    You are correct. Ideally internal communication is always via a Private IP only. There are use cases but best practice is that EC2s do not have public IPs and use a Load balancer where needed for accessing EC2s from the internet. https://docs.aws.amazon.com/config/latest/developerguide/ec2-instance-no-public-ip.html

You are not logged in. Log in to post an answer.

A good answer clearly answers the question and provides constructive feedback and encourages professional growth in the question asker.

Guidelines for Answering Questions

Relevant content