0

After quick standing up of AWS ec2 instance of linux platform, I tried to connect to it via ssh client (e.g. PuTTY) from outside of AWS. By looking at ec2 configuration, it has public IPv address and private IPv address. Btw, I checked http traffic allowed from outside world.

I'd appreciate if someone could explain below questions I have,

  1. I was able to connect remotely to this server with public IP but not with private IP, why?
  2. When I ran ip addr show eth0, it returned private IP. I expected public IP.

I looked up their differences and I think I do understand what below stmt says:

You can use public addresses for communication between your instances and the Internet. AWS resolves an external DNS hostname to the public IP address of the instance outside the network of the instance, and to the private IPv4 address of the instance from within the network of the instance.

1 Answer 1

1

For IPv4 public addresses, AWS does something with EC2 server instances that most new AWS users don't expect. I certainly was confused by it at first.

Although a public IP address is associated with the EC2 server, the public address is not configured on the server itself. Instead, your VPC's Internet Gateway has the public address and it performs address translation. The EC2 server has only its private IP address in its network configuration that you can see with ifconfig or ip addr show.

The EC2 server's private IP address will not be reachable from the public Internet, only the public IP address. From within your VPC, the EC2 server's private IP will be reachable, and if your private subnets have NAT gateways, the EC2 server's public IP will also be reachable.

But you don't really want traffic from inside your VPC to go out to the public Internet only to go through a "hairpin" turn to come back into the VPC and reach this EC2 server. It's a better configuration - and lower cost in network traffic charges - for the rest of your VPC to connect to this EC2 server via its private IP address.


Edited to add this note about AWS IPv6 addresses: AWS created the design for public IPv4 addresses (desscribed above) a number of years ago. AWS has only started supporting IPv6 addresses in the past few years, and the design of how v6 addresses work is different:

When an EC2 server is configured with an IPv6 address (which requires the VPC and subnet to also be given v6 configurations), the EC2 server does have its v6 address configured on the server itself, and the v6 address is visible with network configuration commands like ip addr show. The VPC's Internet Gateway does not perform address translation.

There might be use cases that I don't know about where this works differently (such as BYOIP - Bring Your Own IP [addresses] that larger customers can use), but for customers who use IP addresses provided by AWS (most of them, I believe), this is how it works.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .