aws ecs docker 容器无法访问互联网

Question

I have an ECS cluster one container instance. I have an ECS service and corresponding task which deploys the REST API. For some reason, the internet is not reachable out of the container, but it is out from the container instance. As you can see from pic #4, the task is deployed in the subnet subnet-4e211127(Public Subnet 2) settings of which you may see in pic #8. It uses an internet gateway(igw). According to this SO , to make the ECS container reaching the internet, I need it should be deployed in the subject associated with nat.

So, when I edit Public Subnet 2 to use nat instead of igw I lost ssh connection to my container instance(ec2). Could it be the reason that my ec2 instance and ecs task use the same subnet and when I switch from igw to nat it affects ec2 ssh as well? You may find ec2 instance settings on pic #1.

Should I use different subnets for tasks and ec2 instances? You may it in pic #2.

It's not the case. I tried to use different subnets for ec2 and ECS tasks, the result is the same: the internet is not reachable out of the container, but ssh stayed working when I switched from igw to nat .

Security groups associated with the ec2 do not obligate any restriction on outgoing traffic.

I also tried some tricks with iptables on the host(not container) but it didn't help:

sudo iptables -I INPUT -i eth0 -m state --state ESTABLISHED,RELATED -j ACCEPT
sudo iptables -I OUTPUT -o eth0 -d 0.0.0.0/0 -j ACCEPT

Folks, could you please revise my current setup and give some hints about what I missed. Here are some details about my setup:

1. Container Instance(EC2):

2. Security Group(outbound rules):

3. ECS Service

4. ECS Task

5. VPC configuration

6. Private Subnet

7. Public Subnet 1

8. Public Subnet 2

9. Roundtable rtb-7b352e13 / rt-nat

10. Routetable rtb-08ae0e5d4eedfb60b / rt-igw

Answer 1

There maybe different causes but base on your info I suggest

• First make sure your ECS instance and aws-vpc Task stay in same subnet
• Don't put ecs instance in public subnet. The statement that you can still do SSH to your instance mean your instance are in public subnet, and have a public IP. Everything in public subnet need a public IP to communicate with internet, simply put it in public subnet doesn't work. So you need to move ecs instance to private subnet where it can only access internet through NAT GW, then start your container on same subnet (normally ecs will start your container in same subnet with your ecs instance if you configure right "allowed subnets" in ECS service)