Difference between EC2 "Elastic IP" and "IPv4 Public IP"

Viewed 825

I would like to understand the difference between Elastic IP and IPv4 Public IP that's assigned to an EC2 instance and their significance.

I have been trying to connect to the Internet from an EC2 instance I launched within a new public subnet created within a new VPC. I created a new Internet Gateway, a new route table, a new network ACL, and a new security group and configured them appropriately.

However, I am unable to connect to the Internet from the EC2 instance even though I was able to SSH into it remotely.

Going over Internet forums, I learned that for an EC2 instance to connect to the Internet from a public subnet, the instance should have an Elastic IP. The instance I created has IPv4 Public IP, but not Elastic IP. Can someone please explain the need for an Elastic IP?

Here are the steps to replicate this issue:

  1. Create a new VPC (Services -> Networking & Content Delivery -> VPC -> Virtual Private Cloud -> Your VPCs).
    IPv4 CIDR: 10.0.0.0/16.
    Set Edit DNS Hostnames -> Yes.
  2. Create a new Subnet (Virtual Private Cloud -> Subnets) in the above VPC.
    IPv4 CIDR: 10.0.0.0/24.
    Set Modify auto-assign IP settings -> Enable auto-assign public IPv4 address.
  3. Create a new Internet Gateway (Virtual Private Cloud -> Internet Gateways). Attach to VPC and select the new VPC.
  4. Create a new Route Table (Virtual Private Cloud -> Route Tables) and associate it with the new VPC.
    Routes tab -> Edit -> Add another route -> Destination: 0.0.0.0/0 and Target: above Internet Gateway.
    Subnet Associations -> Associate -> Select the earlier created new Subnet -> Save.
  5. Create a new Network ACL (Virtual Private Cloud -> Security -> Network ACLs) and associate it with the new VPC.
    Inbound Rules -> Edit ->
    Rule # Type Protocol Port Range Source Allow / Deny
    100 SSH (22) TCP (6) 22 0.0.0.0/0 ALLOW
    200 HTTP (80) TCP (6) 80 0.0.0.0/0 ALLOW
    300 HTTPS (443) TCP (6) 443 0.0.0.0/0 ALLOW

    Outbound Rules -> Edit ->
    Rule # Type Protocol Port Range Source Allow / Deny
    100 ALL Traffic ALL ALL 0.0.0.0/0 ALLOW

    Subnet Associations -> Associate with the new Subnet -> Save

  6. Create a new Security Group (Virtual Private Cloud -> Security -> Security Groups) and associate it with the new VPC.
    Inbound Rules -> Edit ->
    Type Protocol Port Range Source
    HTTP (80) TCP (6) 80 0.0.0.0/0
    SSH (22) TCP (6) 22 0.0.0.0/0
    HTTPS (443) TCP (6) 443 0.0.0.0/0

    Outbound Rules (No change and as below)
    Type Protocol Port Range Source
    ALL Traffic ALL ALL 0.0.0.0/0

  7. Launch a new Ubuntu Server 16.04 LTS EC2 instance.
    Configure Instance -> Network -> New/created VPC
    Configure Instance -> Subnet -> New/created Subnet (auto selected)
    Configure Security Group -> Select an existing security group -> New/created security group -> Review and Launch
    In EC2 instance description, Elastic IPs will be blank and IPv4 Public IP will be populated (this difference is what that lead to my question).
  8. SSH into the new Ubuntu EC2 instance with login: ubuntu Run $ sudo apt-get update and there is no response.

I am not sure what else needs to be done for the EC2 instance to access the internet or in which step am I making a mistake. As the instance is in the public subnet of VPC, I don't think moving it to a private subnet and connecting via NAT would be a good option. All I want is direct connectivity to the Internet from the EC2 instance.

(Thanks John for the formatting help and everyone who responded)

3 Answers

The issue is probably with the NACL inbound rules. You need to allow for inbound traffic from the ephemeral port range(1024-65535). When you try to connect to a server, the server assumes a port in this range to send the response. Since your NACL wouldn't allow it, it doesn't come back to you.

NACL defaults allow all inbound and outbound traffic. So it works. Your issue is the reverse of what is mentioned here.

Related