How do I troubleshoot connectivity issues between two endpoints in VPC?

Resolution

Note: To troubleshoot network connectivity issues between an Amazon VPC endpoint and an on-premises host over an internet gateway, see How do I troubleshoot network performance issues between Amazon Elastic Compute Cloud (EC2) Linux or Windows instances in a VPC and an on-premises host over the internet gateway?

Troubleshoot connectivity issues with Amazon VPC Reachability Analyzer

Use Reachability Analyzer to analyze the path between your resource and the destination. For more information, see How Reachability Analyzer works.

Note: To analyze paths across multiple AWS accounts, activate trusted access for Reachability Analyzer with your organization from AWS Organizations. Reachability Analyzer supports cross-account analysis for only accounts inside your organization.

You can also use Amazon Q to use natural language queries to troubleshoot issues with Reachability Analyzer. For more information, see Introducing Amazon Q support for network troubleshooting (preview).

Troubleshoot connectivity issues with the AWSSupport-ConnectivityTroubleshooter Automation

Run the AWSSupport-ConnectivityTroubleshooter Automation to check for connectivity issues.

Troubleshoot connectivity issues with Amazon VPC Flow Logs

Activate Amazon VPC Flow Logs. Then, perform the following checks in your flow logs:

• Look for REJECT entries.
• Verify that source and destination IP addresses are correct.

Use the following tools to analyze your flow logs:

• If you store your flow logs in Amazon CloudWatch, then use CloudWatch Logs Insights to query your flow logs. You can also use CloudWatch Log Insights to analyze custom flow logs.
• If you store your flow logs in Amazon Simple Storage Service (Amazon S3), then use Amazon Athena to analyze your flow logs. You can also use Athena to run a predefined query for your flow logs. For more information, see Analyze VPC Flow Logs with point-and-click Amazon Athena integration.

For more information, see Flow log records and Flow log record examples.

Manually troubleshoot configuration issues

DNS resolution issues across peered VPCs

If you use a VPC peering connection, then, make sure that you activated the following DNS attributes for both VPCs:

• AmazonProvidedDNS.
  Note: If you configured your VPC with AmazonProvidedDNS, then troubleshoot VPC peering connection issues related to DNS resolution.
• DNS hostnames.
• DNS resolution for the peering connection.

Then, activate DNS resolution for your VPC peering connection.

DNS configuration issues

To verify that you configured the DNS resolution correctly, complete the following steps:

1. Run the following command based on your operating system (OS):
   For Windows

   nslookup example-destination-domain-name  
   

   For Linux

   dig example-destination-domain-name

   Note: Replace example-destination-domain-name with the destination domain name.

2. In the output, verify that the command returns the expected IP address. If the output doesn’t include the expected IP address, then proceed to step 3.

3. Run the following commands on the custom resolver or Amazon Route 53 Resolver based on your OS:
   For Windows

   nslookup example-domain-name example-resolver

   For Linux

   dig example-domain-name @example-resolver

   Note: Replace example-domain-name with your domain name. Replace example-resolver with the custom DNS address, or the Route 53 resolver IP address. Your resolver Route 53 IP address is your VPC’s CIDR block plus 2.

Connectivity to the destination

Note: In the following commands, Replace example-destination-domain-name with the destination domain name or the destination IP address. Replace example-destination-port with the destination port. Replace example-destination with the destination.

Run the following commands to test the connectivity on your destination TCP port, based on your OS:

• For PowerShell

  PS C:\Windows\system32> tnc example-domain-name -port example-destination-port

  Note: You must run the previous tnc command in PowerShell when you’re signed in as an administrator.
• For Linux

  nc -zv example-destination.com example-destination-port

  Note: If you didn’t install netcat (nc) on your instance, then install it.
• For Linux and PowerShell

  telnet example-domain-name example-destination-port

  Note: If you didn’t install telnet on your instance, then install it.

Use Wireshark to check network traffic and view captured packet details. For more information, see Wireshark on the Wireshark website. Then, run the following command based on your OS to save your captured traffic details in a .pcap file:

• For Windows

  netsh trace start capture=yes tracefile=test.pcap netsh trace stop

• For Linux

  sudo tcpdump -i any -w test.pcap

Amazon EC2 instance configuration issues

Check the following configurations:

• Check the status of your instance. Verify that your instance is the Running state and passes system and instance status checks.
• Check that your instance has an associated public IP address or Elastic IP address. Be sure to use this IP address when you connect to the instance. For more information, see How can I fix the connection to my Amazon EC2 instance or elastic network interface that has an attached Elastic IP address?

Network ACL, route table, and security group configurations

Verify that your network access control list (network ACLs), inbound and outbound security group rules, and route tables allow all necessary traffic to and from your destination.

Related information

Amazon VPC Reachability Analyzer

AWSSupport-ConnectivityTroubleshooter

AWSSupport-EnableVPCFlowlogs

Logging IP traffic using Amazon VPC Flow Logs