无法将 Internet 与私有子网中的 EC2 实例连接起来

Question

I am trying to install docker on my EC2 instance in private subnet which I have SSH using Jumpbox. I even tried to allow ALL TRAFFIC in my security group, but still didnot happen.

sudo yum update -y
Loaded plugins: priorities, update-motd, upgrade-helper
Could not retrieve mirrorlist http://repo.us-west-1.amazonaws.com/latest/main/mirror.list error was
12: Timeout on http://repo.us-west-1.amazonaws.com/latest/main/mirror.list: (28, 'Connection timed out after 5001 milliseconds')


 One of the configured repositories failed (Unknown),
 and yum doesn't have enough cached data to continue. At this point the only
 safe thing yum can do is fail. There are a few ways to work "fix" this:

     1. Contact the upstream for the repository and get them to fix the problem.

     2. Reconfigure the baseurl/etc. for the repository, to point to a working
        upstream. This is most often useful if you are using a newer
        distribution release than is supported by the repository (and the
        packages for the previous distribution release still work).

     3. Disable the repository, so yum won't use it by default. Yum will then
        just ignore the repository until you permanently enable it again or use
        --enablerepo for temporary usage:

            yum-config-manager --disable <repoid>

     4. Configure the failing repository to be skipped, if it is unavailable.
        Note that yum will try to contact the repo. when it runs most commands,
        so will have to try and fail each time (and thus. yum will be be much
        slower). If it is a very temporary problem though, this is often a nice
        compromise:

            yum-config-manager --save --setopt=<repoid>.skip_if_unavailable=true

Cannot find a valid baseurl for repo: amzn-main/latest

Answer 1

An Amazon EC2 instance in a private subnet cannot directly communicate with the Internet. This is intentional, since it is a private subnet .

To allow such connectivity:

• Create a NAT Gateway in a public subnet in the same VPC
• Modify the Route Table for the private subnet to direct traffic destination 0.0.0.0/0 to the NAT Gateway

When the EC2 instance tries to access the Internet, its request will be sent to the NAT Gateway. The NAT Gateway will make the request on behalf of the instance and will send the response back to the instance. This allows outbound connectivity to the Internet while protecting the instance from inbound connectivity.

It is not strictly necessary to use private subnets. Security Groups can perform a similar function at the instance level rather than at the subnet level.

Answer 2

In this situation, when EC2 is inside VPC and we want to allow EC2 to connect outside world through internet. We need to add outbound rules to EC2. For eg, I wanted to download Docker on EC2 from amazom repository. I have added HTTP rules in below snapshot