AWS nat instance doesn't route to the internet

Question

I have a vpc, the vpc has two subnet, one is public to internet (10.20.7.0/24), one is private (10.20.8.0/24). In public subnet, I have a machine use aws commuity ami to create for NAT, in private subnet, I have a rhel instance for some testing, the following ip of nat and rhel as below

NAT: 10.20.7.100

rhel server: 10.20.8.100

when I tried to telnet one of my company web server in port 80 using rhel server, it always shows connection refused, unable connect to the remote host

Here is my NAT server setting

[ec2-user@ip-10-20-7-100 ~]$ sudo iptables -t nat -L -nv
Chain PREROUTING (policy ACCEPT 9 packets, 460 bytes)
Chain PREROUTING (policy ACCEPT 9 packets, 460 bytes)
pkts bytes target     prot opt in     out     source               destination
1    60 DNAT       tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            tcp dpt:80 to:10.20.8.100

Chain INPUT (policy ACCEPT 9 packets, 460 bytes)
pkts bytes target     prot opt in     out     source               destination


Chain OUTPUT (policy ACCEPT 9 packets, 640 bytes)
pkts bytes target     prot opt in     out     source               destination

Chain POSTROUTING (policy ACCEPT 0 packets, 0 bytes)
pkts bytes target     prot opt in     out     source               destination
100  6551 MASQUERADE  all  --  *      eth0    10.20.0.0/16         0.0.0.0/0

The iptables service is on

[ec2-user@ip-10-20-7-100 ~]$ chkconfig --list | grep iptables
iptables        0:off   1:off   2:on    3:on    4:on    5:on    6:off

Any missing on NAT server and private rhel server, or aws setting? kindly advise!

Answer 1

Are you trying to telnet one of your company's web server on the public subnet or on the Internet/corporate network ?

If you are trying to telnet an instance (your web server) within the same VPC and the same subnet.

• And if the security group of your VPC is not the default, you need to add the rule to allow that security group. (the default security group has this rule by default).

• Make sure you disable source/destination check.

• Make sure the routing table for the private subnet has the NAT instance as a default route.

• Make sure your ACLs are allowing the needed traffic. Check Recommended Network ACL Rules for Your VPC