Debugging Networking Issues Using VPC Reachability Analyzer

In this post, we’ll see how we can use VPC Reachability Analyzer to debug networking issues in the AWS environment.

Step1: Create 2 VPCs and connect them using VPC peering. Next, launch 1 instance in both the VPCs. In the security group settings of these instances, allow access on port 22 from respective VPC CIDR only.

For both instances, we’ll also deny all traffic at the NACL level.

Step 2: Now go to VPC->Reachability Analyzer->Create and analyze path and specify our source(instance in VPC1), destination(instance in VPC2), and port(22).

Run the analysis. Once it’s completed, you can see the following findings in the result.

Based on the findings, we can see that route tables of both instances don’t have a path to access instances in another VPC.

Step 3: Add entries in the route tables to use our VPC peering connection to connect to other VPCs and run the same check again.

This time, we can see that traffic is getting blocked at the NACL level since we changed our default Allow rule to Deny.

Step 4: Revert the Default Deny rule in NACL to Allow and run the check again.

Now we can see that traffic is still not reaching instance2 as its security group does not allow traffic from outside the VPC.

Step 5: In the security group of instance2, allow access on port 22 from IP on instance1.

Now run the check again and it should be reachable now.

You can also view the entire network path used to reach out to instance2.

As you can see, a Reachability analyzer can be a very handy tool while debugging complex networking issues. Earlier we used to do all these checks manually but now we have a Reachability analyzer to take care of such analysis.

Reference: https://docs.aws.amazon.com/vpc/latest/reachability/what-is-reachability-analyzer.html

👋 Join us today !!

️Follow us on LinkedIn, Twitter, Facebook, and Instagram

https://avmconsulting.net/

If this post was helpful, please click the clap 👏 button below a few times to show your support! ⬇

--

--

--

AVM Consulting — Clear strategy for your cloud

Recommended from Medium

PySpark recipe

FIleMaker 17: Perform Script by Name

Setting Up AWS ECS Standalone Service Deployment On Image Push Using Terraform

Using Github Actions to deploy Blazor to App Service with private endpoint enabled

How to take screenshots in Selenium without coding

Fn Project & Caddy for Fun & Learning

Writing your own Operating System

Hacking with Swift — Learning Project 12

Get the Medium app

A button that says 'Download on the App Store', and if clicked it will lead you to the iOS App store
A button that says 'Get it on, Google Play', and if clicked it will lead you to the Google Play store
Vinayak Pandey

Vinayak Pandey

Experienced Cloud Consultant with a knack of automation. Linkedin profile: https://www.linkedin.com/in/vinayakpandeyit/

More from Medium

Building production grade EKS clusters using Terraform

AWS Cloud Cost Optimization : Part 1

[Terraform]: Build Amazon Redis Cache from SNAPShots not are supported. Wait What!!

AWS Database Authentication with IAM