0

I'm running a cluster of machines that have the following routing information:

core@ip-10-0-0-216 ~ $ route -n
Kernel IP routing table
Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
0.0.0.0         10.0.0.1        0.0.0.0         UG    1024   0        0 eth0
10.0.0.0        0.0.0.0         255.255.252.0   U     0      0        0 eth0
10.0.0.1        0.0.0.0         255.255.255.255 UH    1024   0        0 eth0
172.17.0.0      0.0.0.0         255.255.0.0     U     0      0        0 docker0

The machines are running in 10.0.0.0/16 and I have an RDS instance running in 172.30.0.0/16, and I've set up VPC peering between the two VPC's and the routing information as well.

For some reason, this routing information doesn't seem to be reflected in my gateway since whenever I try to access my RDS instance, the connection simply times out.

How do I add a route to my linux instances? Moreover, these instances belong to an autoscaling group, because of which I'd like to have this route added dynamically to any new instances that might come up.

Thanks.

3
  • You don't add them the instance route tables. The default gateway used by the instance is the VPC router, and it will use the route tables for the subnet to find the destination... both VPCs need routes in their route tables, and the RDS security group needs to allow the foreign machines by their IPs, not by their source security group. Do you have all this in place? Sep 21, 2015 at 12:53
  • @Michael-sqlbot yes I do, I cannot still connect to the RDS instance from 10.0.0.0/16 and I just get timeouts.
    – Ashesh
    Sep 21, 2015 at 16:36
  • Launch an instance in 172.30 VPC. Run tcpdump -nn icmp and then ping it from 10.0.0.216. Check if the packets are getting from 10.0 to 172.30 - will give you an idea whether its the forward path or return. As Michael said, you need a 172.30 route in the route table that is applied to the 10.0.0.0/24 SUBNET, and a route for 10.0.0.0 in the 172.30.x/24 SUBNET. Also check your network ACLs and the SGs of both 10.0.0.216 outbound and RDS inbound. Each VPC has their own set of SGs, so it can be helpful to debug SG rules that allow by IP instead of SG identifier.
    – Brett
    Sep 30, 2015 at 8:42

0

You must log in to answer this question.

Browse other questions tagged .