By using AWS re:Post, you agree to the AWS re:Post Terms of Use
AWS re:Postre:Post

A browser launched from EC2 Win Server running in private subnet cannot open web site hosted by IIS on EC2 Win Server in public subnet.

0

My simplified network architecture is as follows:

  1. VPC has a public and private subnets.
  2. Public Subnet is connected to Internet Gateway.
  3. Private subnet is connected to Internet through NAT.
  4. Public EC2 Win Server has public IP4: 13.22.45.23 and private IP4: 10.0.10.15. The security group allows incoming traffic from private EC2 Web server on ports 80, 1433 and 433.
  5. Security group of private EC2 Win Server allows incoming traffic from the public EC2 Web server on ports 80, 1433 and 433.
  6. Public website https://MyWebSite.com/MyWebApplication has binding to port 443 and hostname associated with EC2 Win Server's public IP4 address. The hostname is registered in AWS Route 53, i.e. MyWebSite.com is associated with 13.22.45.23.

What I tried:

  1. Test #1 - Successfully opened website in my laptop typing https://MyWebSite.com/MyWebApplication in Chrome browser. This proved that website was working and was accessible from Internet.
  2. Test #2 - RDC'd to private EC2 Win Server and successfully opened random Internet websites in Chrome browser. This proved that private EC2's Internet connection works OK. Note, private EC2 is connected to Internet through NAT installed in public subnet.
  3. Test #3 - RDC'd to private EC2 Win Server and successfully opened Default website (port:80) hosted by public EC2 Win Server IIS. I opened it using private IP address of public EC2 instance, i.e. typing http://10.0.10.15 in Chrome. This proved that HTTP requests go through OK from private to public subnet.
  4. Test #4 - RDC'd to private EC2 Win Server and tried to open https://MyWebSite.com/MyWebApplication. The browser displayed a message 'This site can’t be reached. MyWebSite.com took too long to respond'
  5. Test #5 - Tried the same test #4 above but using public IP4 address of the public EC2, i.e. using URL https://13.22.45.23/MyWebApplication. The result was the same like in test #4.
  6. Test #6 - Tried the same test #4 above but using private IP4 address of the public EC2, i.e. using URL https://10.0.10.15/MyWebApplication. The result was the same like in test #4.

The problem is the https://MyWebSite.com/MyWebApplication exposes Web API endpoints that I need to call from the private subnet. Because all calls failed, I did the above connection tests.

I don't understand why I can open https://MyWebSite.com/MyWebApplication from outside of my VPC but can't from the private subnet. In fact, as I mentioned above, I can can open any https websites from the private subnet except MyWebsite.com. I wonder what is special about it?

I must admit that the real VPC looks more complex than I described in the beginning. It has Load Balancers associated with Cloud Watch, Event Bridge, Private Link and API Gateway. None of the load balancers have listeners on port 443 though.

Can anyone please advise any directions where should I look at for a solution ?

Thank you.

Topics
Networking & Content DeliveryCompute.NET on AWS
Tags
Amazon VPCAmazon EC2Networking & Content DeliverySecurity Group.NET on AWS
Language
English
rePost-User-4543988
asked 2 years ago301 views
2 Answers
0

Based on the information provided, it seems that the issue is related to the routing of traffic between the private and public subnets in your VPC. Specifically, it appears that traffic from the private subnet is not being properly routed to the public subnet where the Web API hosted on your public EC2 instance is located.

One possible solution to this issue could be to check the routing table for the private subnet to ensure that it is properly configured to route traffic to the public subnet. Additionally, you should check the security group rules for the private and public subnets to ensure that they are configured to allow traffic between the subnets on the necessary ports (443 in this case).

Another possible issue could be the load balancer, check the listeners associated with it, and make sure it's not blocking port 443 traffic.

You should also check your Network ACLs (NACLs) for the public and private subnets to ensure that they are allowing traffic between the subnets on the necessary ports.

It's also worth checking the VPC peering connections and make sure it's not blocking the traffic.

Varun Mittal
answered 2 years ago
  • rePost-User-4543988
    2 years ago

    Thank you, Varun. Have checked everything that you advised: route tables, SG's, load balancer listeners and targets, ACL's, Private Link Service Endpoint. Also, I did Reachability Analyzer successful test between two EC2 instances. All looks correct but connection still does not work. I've done another test: I created a new website in Public EC2 IIS with binding to port 443 but with empty hostname. I tried to reach the new website from private EC2 using Public EC2 private IP4 address, i.e. https://10.0.10.15/MyNewWebSite. This worked. I still don't understand why https://MyWebSite.com/MyWebApplication does not work in private EC2. It looks like hostname MyWebSite.com associated with public EC2 IP4 address is the problem. But I don't understand why.

0

Try running Reachability Analyzer, int's in the VPC page on the AWS console, you can use it to analyze the path between the two EC2 instances and see where it's blocked.

profile pictureAWS
AWS-dhelper
answered 2 years ago
  • rePost-User-4543988
    2 years ago

    Thank you Dror Helper. Have used Reachability Analyzer between Public and Private instances through port 443 and the Reachability Status is Reachable.

You are not logged in. Log in to post an answer.

A good answer clearly answers the question and provides constructive feedback and encourages professional growth in the question asker.

Guidelines for Answering Questions

Relevant content