My EC2 Linux Instance on AWS can't connect to internet

Currently, SSH is available, so EC2 should be publicly accessible. If there is a problem with the route table, you need to check the route table associated with the subnet where EC2 is running.

Is it possible to resolve the name "google.com" using the "dig" or "nslookup" command?

dig google.com
nslookup google.com

If name resolution is not possible, try adding the IP of Google's name server as shown below to force name resolution. https://repost.aws/knowledge-center/ec2-static-dns-ubuntu-debian

sudo vi /etc/resolv.conf

nameserver 8.8.8.8

By default, the settings are as follows. The IP address changes depending on the CIDR of the VPC you are using.

cat /etc/resolv.conf
# This is /run/systemd/resolve/resolv.conf managed by man:systemd-resolved(8).
# Do not edit.
#
# This file might be symlinked as /etc/resolv.conf. If you're looking at
# /etc/resolv.conf and seeing this text, you have followed the symlink.
#
# This is a dynamic resolv.conf file for connecting local clients directly to
# all known uplink DNS servers. This file lists all configured search domains.
#
# Third party programs should typically not access this file directly, but only
# through the symlink at /etc/resolv.conf. To manage man:resolv.conf(5) in a
# different way, replace this symlink by a static file or a different symlink.
#
# See man:systemd-resolved.service(8) for details about the supported modes of
# operation for /etc/resolv.conf.

nameserver 172.31.0.2
search ap-northeast-1.compute.internal

To begin with, I feel like there is a problem with the VPC CIDR. I thought there was a problem because it was outside the range of private IP addresses specified in RFC 1918. https://docs.aws.amazon.com/vpc/latest/userguide/vpc-cidr-blocks.html#vpc-sizing-ipv4

The CIDR of a VPC cannot be changed once it has been created, so you will need to recreate the VPC.

Hey!

So I managed to fix this issue. The problem was actually with my organization, apperently there is an extra layer of security which does not allow internet communication on VPC. I had to use a Security Group that is made by my company, it has 50 custom made rules which unfortunetley I am not allowed to share due to obvious security reasons. But I would suggest you re create your VPC, Instance and Security group. In my case I did everything correct but there was small issue which was blocking me from internet that was related to organization which am working for. So its very specific.

Hi there, sounds like your NACL is blocking the traffic. NACL is stateless, so you will need to allow both inbound and outbound for the traffic to be allowed. e.g. when connecting out to the internet on port 80, you need to allow outbound port 80, and inbound on ephemeral port (normally 1024-65535)