EC2 Instances in eu-south-2 Subnet Cannot Access Internet Despite Correct NAT and Routing Setup.

Hello.

Does the MikroTik router run as a NAT instance within a VPC?
If you are configuring it as a NAT instance, make sure you disable "Source/destination checking" on the ENI.
If this setting is not disabled, it cannot be used as a NAT instance.
https://docs.aws.amazon.com/vpc/latest/userguide/work-with-nat-instances.html#EIP_Disable_SrcDestCheck

Based on your questions, there are 3 more things you can check.

• Check VPC NACL and check if you have outbound traffic allowed. You need to have an outbound rule and ALLOW traffic 0.0.0.0/0 for all ports (reduce ports if necessary after testing).
• Ping 1.1.1.1, see if you get a response. Then ping google.com and see if you get a response. If you don't get a response, it means it's not resolving DNS. Make sure, you have the right DNS setting and have not updated VPC DHCP options.
• Confirm there is no additional firewall on the EC2 itself.

Based on the information provided, it appears that you're experiencing a complex networking issue with your EC2 instances in the eu-south-2 region. While you've replicated the configuration from a working setup in eu-west-3, there are several potential causes for the connectivity problems you're encountering.

First, let's address the NAT gateway setup. In AWS, for instances in a private subnet to access the internet, you typically use a NAT gateway placed in a public subnet. This NAT gateway should have an Elastic IP address associated with it. Make sure your NAT gateway is properly configured and in an "Available" state. You can check this in the Amazon VPC console under the NAT Gateways section.

Next, verify that your VPC has an Internet Gateway attached to it. The NAT gateway requires an Internet Gateway to function properly. Without it, the NAT gateway cannot route traffic to the internet.

Check the route table associated with your public subnet (where the NAT gateway is located). It should have a route for 0.0.0.0/0 pointing to the Internet Gateway. This is crucial for the NAT gateway to have internet connectivity.

For the private subnet where your EC2 instances are located, ensure that the route table has a route for 0.0.0.0/0 directed to the NAT gateway.

You mentioned using a MikroTik router with NAT masquerade and forwarding rules. While this is an unconventional setup for AWS, make sure that the MikroTik router is properly configured to forward traffic from your private subnet to the NAT gateway.

Also, check your VPC's DNS settings. Ensure that DNS hostnames and DNS resolution are enabled for your VPC. These settings are necessary for proper name resolution.

Verify that your Network Access Control Lists (NACLs) allow both inbound and outbound traffic appropriately. NACLs are stateless, so you need to explicitly allow both directions of traffic.

If you've verified all these points and are still experiencing issues, you may want to use VPC flow logs to analyze the traffic patterns and identify where the communication is breaking down. Additionally, checking the CloudWatch metrics for your NAT gateway can provide insights into its performance and any potential issues.

Lastly, if none of these suggestions resolve the issue, consider creating a new EC2 instance from an AMI of the original one. This approach has helped resolve similar connectivity issues in some cases.

If the problem persists after trying these steps, it may be worth contacting AWS support, as there could be an underlying infrastructure issue or a very subtle configuration problem that's not immediately apparent.
Sources
Instances within the private subnet are unable to access the internet using NAT gateway. | AWS re:Post
EC2 instance with public IP can't access internet (HTTPS 443 timeout) | AWS re:Post