CODEWITHSUNDEEP
amazon-ec2amazon-vpc
wshyang
wshyang

Reputation: 43

EC2 instance that is accessible from the internet, but not able to access the internet?

I've been trying to launch an EC2 instance that has the following requirements:

  1. It needs to be accessible from the internet (ie: via RDP)
  2. However from inside the EC2 instance it is not able to access the internet.

Initially, my thought is that the instance should be launched in a subnet that has its route table entry 0.0.0.0/0 to the IGW removed.

However, when that route table entry was removed, our RDP connection into the EC2 instance fails.

My next try was to remove all outbound rules from the instance's security group. This stops all external internet access for the instance for good, however the instance is also no longer able to access anything on the intranet.

Is it possible for an instance to still access resources on the local network, but have no routable access out to the internet?

Thanks all!

Upvotes: 0

Views: 312

Answers (1)

John Rotenstein
John Rotenstein

Reputation: 270039

It appears that your requirements are:

  • Allow inbound access to the instance (working)
  • Deny outbound access to the Internet (working)
  • Allow access to other resources in the same VPC (not working)

To achieve this, you should:

  • Remove all Outbound rules on the security group
  • Add an Outbound rule that permits All Traffic to the CIDR range of the VPC

So, if the VPC has a CIDR of 10.0.0.0/16, then put this CIDR range in the Outbound security group rule.

Upvotes: 1

Related Questions