Examkin

Soru

Zorluk: ZorVPC Connectivity and Routing Troubleshooting

A SysOps administrator is troubleshooting internet connectivity issues for an Amazon EC2 instance in a private subnet with CIDR block 10.0.1.0/2410.0.1.0/24. The VPC contains a public subnet with CIDR block 10.0.0.0/2410.0.0.0/24. To save costs, the administrator deployed a custom EC2 NAT instance in the public subnet instead of a NAT Gateway.

The administrator has performed the following configuration steps:
- Configured the private subnet's route table with a route for 0.0.0.0/00.0.0.0/0 targeting the network interface (ENI) of the NAT instance.
- Configured the public subnet's route table with a route for 0.0.0.0/00.0.0.0/0 targeting the VPC's Internet Gateway.
- Enabled IP forwarding in the operating system of the NAT instance.
- Configured the security groups and Network ACLs to allow all traffic.

Despite these settings, the EC2 instance in the private subnet cannot reach any internet resources. Which of the following actions will resolve this connectivity issue?

  1. Disable the source/destination check attribute on the NAT instance's network interface.Cevap
  2. B
    Modify the route table of the public subnet to add a route for the private subnet CIDR block (10.0.1.0/2410.0.1.0/24) targeting the NAT instance.
  3. C
    Update the security group of the private EC2 instance to allow inbound traffic on ephemeral ports 10241024-6553565535 from the NAT instance.
  4. D
    Create a Gateway VPC Endpoint for NAT and associate it with the route table of the private subnet.

Cevap

Disable the source/destination check attribute on the NAT instance's network interface.
By default, Amazon EC2 instances perform source/destination checking. This means the instance must be the source or destination of any traffic it sends or receives. Because a NAT instance acts as an intermediary, forwarding traffic where it is neither the original source nor the final destination, the Source/Destination Check attribute must be disabled on its network interface to allow forwarding of internet-bound traffic from the private subnet.

Adım Adım Çözüm

1
Analyze the packet path from the private instance to the internet.
The packet goes from the private instance to the private route table, which correctly redirects 0.0.0.0/00.0.0.0/0 traffic to the NAT instance's network interface (ENI).
Verifies that the route tables are configured to send internet traffic to the NAT intermediary.
2
Check the default AWS EC2 network interface attributes that affect traffic forwarding.
By default, AWS EC2 instances perform source/destination checking, which drops packets where the source or destination IP does not match the instance's own IP.
Since the NAT instance forwards traffic on behalf of the private instance, it will drop forwarded packets under default settings.
3
Disable the Source/Destination Check attribute on the NAT instance's elastic network interface (ENI).
The NAT instance is now permitted to accept, translate, and forward packets that did not originate from it.
This allows the operating system's IP forwarding configurations to route the packets successfully to the Internet Gateway.

Anahtar Kavram

Disabling Source/Destination Checking on NAT and Firewall Instances
Bu soruyu puanla

Konular

VPC Connectivity and Routing Troubleshooting

Bu konudan daha fazla soru