CODEWITHSUNDEEP
amazon-web-servicesdnspingamazon-route53amazon-vpc
Venkatesh
Venkatesh

Reputation: 59

DNS resolution in aws from EC2

If spinned up an EC2 instance in a vpc, I removed all outbound rules for security group of EC2, when I ping any public domain like google.com, Facebook.Com from server, still its getting the ip address of domain(similarly pinging Google.com {ipaddress} with 32 bytes of data). From where does instance gets ip address of domain and on which port? even though I blocked all outbound rules of security group?

Upvotes: 1

Views: 2951

Answers (1)

jarmod
jarmod

Reputation: 78693

AWS security groups and network ACLs don't filter traffic to or from:

  • AWS reserved IPv4 addresses (these are the first four IPv4 addresses of the subnet, including the Amazon DNS server address for the VPC)
  • link-local addresses (169.254.0.0/16)

The Amazon-supplied VPC DNS server is at the VPC subnet CIDR base +2 address (e.g. 10.0.0.2 if your VPC subnet CIDR is 10.0.0.0).

See Internetwork traffic privacy in Amazon VPC.

Upvotes: 3

Related Questions