Otdfbt

Non-aqueous eyes?

Why was this person allowed to become Grand Maester?

How to make insert mode mapping count as multiple undos?

Is this a bug in plotting step functions?

Why does this query, missing a FROM clause, not error out?

Why not invest in precious metals?

How can one's career as a reviewer be ended?

Return a String containing only alphabets without spaces

How do free-speech protections in the United States apply in public to corporate misrepresentations?

Are inverted question and exclamation mark supposed to be symmetrical to the "normal" counter-parts?

Why can my keyboard only digest 6 keypresses at a time?

Printing Pascal’s triangle for n number of rows in Python

Is it legal for a bar bouncer to confiscate a fake ID

How can I end combat quickly when the outcome is inevitable?

Does the new finding on "reversing a quantum jump mid-flight" rule out any interpretations of QM?

Ability To Change Root User Password (Vulnerability?)

Next date with distinct digits

How Does AlphaGo Zero Implement Reinforcement Learning?

Teaching a class likely meant to inflate the GPA of student athletes

Why are MBA programs closing?

Should I refuse being named as co-author of a bad quality paper?

I've been given a project I can't complete, what should I do?

Should I put programming books I wrote a few years ago on my resume?

Someone whose aspirations exceed abilities or means

aws iptables nat works on eth0 but not on eth1

Linux IPTables Destination NAT with Asymmetrical Routing?iptables block 1 ip, natBasic iptables NAT port forwardingejabberd on vm not connect to another xmmp server (iptables dnat dport 5269)iptables - Block incoming on Eth1 and Allow All from eth0Openswan tunnel to remote public NAT'd hostIPTables: NAT multiple IPs to one public IPConnect AWS and Azure via OpenVPNConfig differents external proxy to every VM with iptablesiptables SNAT rule works for ICMP and TCP, but not for UDP

.everyoneloves__top-leaderboard:empty,.everyoneloves__mid-leaderboard:empty,.everyoneloves__bot-mid-leaderboard:empty height:90px;width:728px;box-sizing:border-box;

1

I have a very simple setup: two t2.micro instances, one with eth0, and the other with eth0 and eth1, both in the same VPC with a 10.0.0.0/24 subnet in 10.0.0.0/16.

All I'm trying to do is have traffic from the internet routed through one t2 into the other, and return.

Here is the test setup, followed by what works, then by what does not work. I need to make the second scenario work, and can't figure out how.

/proc/sys/net/ipv4/ip_forward = 1

t2-A: eth0 private IP 10.0.0.120 EIP a0.b0.c0.d0
 eth1 private IP 10.0.0.16 EIP a1.b1.c1.d1

t2-B: eth0 private IP 10.0.0.113

I can ping a0.b0.c0.d0, the pings come in to 10.0.0.120, are NATed and routed to 10.0.0.113, and the ping replies come back out a0.b0.c0.d0 to me.

All it takes is these two rules:

iptables -t nat -I PREROUTING -i eth0 -p icmp -j DNAT --to 10.0.0.113
iptables -t nat -I POSTROUTING -o eth0 -p icmp -j MASQUERADE

But if I try to do the same thing through eth1, I can't get it to work:

iptables -t nat -I PREROUTING -i eth1 -p icmp -j DNAT --to 10.0.0.113
iptables -t nat -I POSTROUTING -o eth1 -p icmp -j MASQUERADE

Ping a1.b1.c1.d1 does not work. I can see the pings hitting 10.0.0.16, and nothing else happens after that. The pings never show up on 10.0.0.113 or any other interface, so of course ping replies are not sent.

When I first ran into this, I opened an aws support ticket, and they suggested it was an asymmetrical routing issue, and told me to do the following, something about policy-based routing:

ip route add default via 10.0.0.1 dev eth0 table 1
ip route add default via 10.0.0.1 dev eth1 table 2
ip rule add from 10.0.0.120/32 table 1 priority 500
ip rule add from 10.0.0.16/32 table 2 priority 600

I did that, but it had no effect at all on the problem.

Do you have any ideas?

amazon-web-services iptables

share|improve this question

edited May 24 at 17:47

chicks

3,09072033

asked May 24 at 16:26

SinbadSinbad

61

• 
  
  
  

  
  

  
  
  
  
  
  

  
  
  Submitted this exact question to AWS Support. They said they were able to reproduce the problem, said it is an AWS problem, but they have no solution at this time. They did not say whether they were going to submit an internal bug on it. So we will move ahead using eth0 as the NAT interface, since that is the only one that works.
  
  – Sinbad
  May 29 at 2:34
  

  
  
  
  

add a comment | 

1

I have a very simple setup: two t2.micro instances, one with eth0, and the other with eth0 and eth1, both in the same VPC with a 10.0.0.0/24 subnet in 10.0.0.0/16.

All I'm trying to do is have traffic from the internet routed through one t2 into the other, and return.

Here is the test setup, followed by what works, then by what does not work. I need to make the second scenario work, and can't figure out how.

/proc/sys/net/ipv4/ip_forward = 1

t2-A: eth0 private IP 10.0.0.120 EIP a0.b0.c0.d0
 eth1 private IP 10.0.0.16 EIP a1.b1.c1.d1

t2-B: eth0 private IP 10.0.0.113

I can ping a0.b0.c0.d0, the pings come in to 10.0.0.120, are NATed and routed to 10.0.0.113, and the ping replies come back out a0.b0.c0.d0 to me.

All it takes is these two rules:

iptables -t nat -I PREROUTING -i eth0 -p icmp -j DNAT --to 10.0.0.113
iptables -t nat -I POSTROUTING -o eth0 -p icmp -j MASQUERADE

But if I try to do the same thing through eth1, I can't get it to work:

iptables -t nat -I PREROUTING -i eth1 -p icmp -j DNAT --to 10.0.0.113
iptables -t nat -I POSTROUTING -o eth1 -p icmp -j MASQUERADE

Ping a1.b1.c1.d1 does not work. I can see the pings hitting 10.0.0.16, and nothing else happens after that. The pings never show up on 10.0.0.113 or any other interface, so of course ping replies are not sent.

When I first ran into this, I opened an aws support ticket, and they suggested it was an asymmetrical routing issue, and told me to do the following, something about policy-based routing:

ip route add default via 10.0.0.1 dev eth0 table 1
ip route add default via 10.0.0.1 dev eth1 table 2
ip rule add from 10.0.0.120/32 table 1 priority 500
ip rule add from 10.0.0.16/32 table 2 priority 600

I did that, but it had no effect at all on the problem.

Do you have any ideas?

amazon-web-services iptables

share|improve this question

edited May 24 at 17:47

chicks

3,09072033

asked May 24 at 16:26

SinbadSinbad

61

• 
  
  
  

  
  

  
  
  
  
  
  

  
  
  Submitted this exact question to AWS Support. They said they were able to reproduce the problem, said it is an AWS problem, but they have no solution at this time. They did not say whether they were going to submit an internal bug on it. So we will move ahead using eth0 as the NAT interface, since that is the only one that works.
  
  – Sinbad
  May 29 at 2:34
  

  
  
  
  

add a comment | 

I have a very simple setup: two t2.micro instances, one with eth0, and the other with eth0 and eth1, both in the same VPC with a 10.0.0.0/24 subnet in 10.0.0.0/16.

All I'm trying to do is have traffic from the internet routed through one t2 into the other, and return.

Here is the test setup, followed by what works, then by what does not work. I need to make the second scenario work, and can't figure out how.

/proc/sys/net/ipv4/ip_forward = 1

t2-A: eth0 private IP 10.0.0.120 EIP a0.b0.c0.d0
 eth1 private IP 10.0.0.16 EIP a1.b1.c1.d1

t2-B: eth0 private IP 10.0.0.113

I can ping a0.b0.c0.d0, the pings come in to 10.0.0.120, are NATed and routed to 10.0.0.113, and the ping replies come back out a0.b0.c0.d0 to me.

All it takes is these two rules:

iptables -t nat -I PREROUTING -i eth0 -p icmp -j DNAT --to 10.0.0.113
iptables -t nat -I POSTROUTING -o eth0 -p icmp -j MASQUERADE

But if I try to do the same thing through eth1, I can't get it to work:

iptables -t nat -I PREROUTING -i eth1 -p icmp -j DNAT --to 10.0.0.113
iptables -t nat -I POSTROUTING -o eth1 -p icmp -j MASQUERADE

Ping a1.b1.c1.d1 does not work. I can see the pings hitting 10.0.0.16, and nothing else happens after that. The pings never show up on 10.0.0.113 or any other interface, so of course ping replies are not sent.

When I first ran into this, I opened an aws support ticket, and they suggested it was an asymmetrical routing issue, and told me to do the following, something about policy-based routing:

ip route add default via 10.0.0.1 dev eth0 table 1
ip route add default via 10.0.0.1 dev eth1 table 2
ip rule add from 10.0.0.120/32 table 1 priority 500
ip rule add from 10.0.0.16/32 table 2 priority 600

I did that, but it had no effect at all on the problem.

Do you have any ideas?

amazon-web-services iptables

share|improve this question

edited May 24 at 17:47

chicks

3,09072033

asked May 24 at 16:26

SinbadSinbad

61

/proc/sys/net/ipv4/ip_forward = 1

t2-A: eth0 private IP 10.0.0.120 EIP a0.b0.c0.d0
 eth1 private IP 10.0.0.16 EIP a1.b1.c1.d1

t2-B: eth0 private IP 10.0.0.113

iptables -t nat -I PREROUTING -i eth0 -p icmp -j DNAT --to 10.0.0.113
iptables -t nat -I POSTROUTING -o eth0 -p icmp -j MASQUERADE

iptables -t nat -I PREROUTING -i eth1 -p icmp -j DNAT --to 10.0.0.113
iptables -t nat -I POSTROUTING -o eth1 -p icmp -j MASQUERADE

ip route add default via 10.0.0.1 dev eth0 table 1
ip route add default via 10.0.0.1 dev eth1 table 2
ip rule add from 10.0.0.120/32 table 1 priority 500
ip rule add from 10.0.0.16/32 table 2 priority 600

share|improve this question

edited May 24 at 17:47

chicks

3,09072033

asked May 24 at 16:26

SinbadSinbad

61

share|improve this question

edited May 24 at 17:47

chicks

3,09072033

asked May 24 at 16:26

SinbadSinbad

61

edited May 24 at 17:47

chicks

3,09072033

edited May 24 at 17:47

chicks

3,09072033

asked May 24 at 16:26

SinbadSinbad

61

asked May 24 at 16:26

SinbadSinbad

61