AWS Create Bastion Host to communicate with your Private Subnet
Tags: aws, cloud, security, communitybuilder
Published: 2023-01-11 20:08:11

Note: This is my first blog post, any recommendations and feedback would be appreciated.

**Introduction**

Bastion Host - A bastion host is a specialized computer that is deliberately exposed on a public network. From a secured network perspective, it is the only node exposed to the outside world and is therefore very prone to attack.

The bastion host processes and filters all incoming traffic and prevents malicious traffic from entering the network, acting much like a gateway. The most common examples of bastion hosts are mail, domain name system, Web and File Transfer Protocol (FTP) servers.

In this post, I will be demonstrating how to configure a VPC in order to communicate two EC2 Instances (One acting as a bastion host and the other one inside a private network).

**Creating VPC**

First Let's start Creating a simple VPC:

![VPC](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/flno7vonk8asf9i97nxy.jpg)

You can use any name or CIDR you want.

**Creating Subnets**

Let's select our VPC (Created in last step):

![SubnetsVPC](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/m8zzq0lrbg9g0qlp8yhu.jpg)

Let's create two subnets, one for the public subnet and the other one for the private subnet.

![Subnets](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/gyslunt3pyl8px96y4me.jpg)

Let's edit the Public Subnet Already created and Check "Enable auto-assign public IPv4 address"

![autoassignipv4](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/ma5819nwuhk53wi1jkoi.jpg)

**Creating Routing Tables**

Route Table for Public Subnet

![PublicRouteTable](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/5jo4zkzltm31p3zlrmo5.jpg)

Route Table for Private Subnet

![PrivateRouteTable](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/6wurhmlq550c1q3z5h4q.jpg)

Edit route table associations so we can add these route tables already created to our subnets:

![RouteTableAssociation](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/ms3228lqrr6btu1ojtsi.jpg)

![PublicSubnetRouteTable](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/aby5m1s4esx1ct4h8bpu.jpg)

![PrivateSubnetRouteTable](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/xvf2ij6pnubzv8s0w95s.jpg)

**Creating Internet Gateway**

Now, We need to create an Internet gateway in order to provide internet access to our Bastion Host

![Internetgateway](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/uwxarxrbhcnys0j7afw7.jpg)

Then, we need to attach this Internet Gateway to our VPC (myDemoVpc)

![IGW1](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/7cfdinbulfstv6fb8rhy.jpg)

![IGW2](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/o52rxyl4mzvw92p094hl.jpg)

Add a Route to this Internet Gateway already attached

![IGW-PublicSubnet-RouteTable](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/q6qswf5mbaho8s9b6gcq.jpg)

![IGW-PublicSubnet-RouteTableAdded](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/mi1b6xv9qy95twl885uf.jpg)

Note: This Route must to be added **ONLY** to our public subnet route table as we're simulating a connection from our bastion host to a private subnet which can contains a database or a server with sensitive data or any other information that must be remain private and cannot reach the internet.

**Creating EC2 Instances**

Let's start creating our Bastion Host and test connectivity trough the internet:

![EC2-Settings](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/wgaldg603etclsnevz68.jpg)

Let's go to the Network Settings Section and Click on Edit to select the options marked

![EC2-Network](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/oy2ffw6pshl85tjiidt5.jpg)

**Testing Connectivity**

Select our instance previously created and click on Connect

![EC2Connectivity](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/h985eb7nrx8jkumai2i8.jpg)

![EC2ConnectivitySSH](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/d004s8pqwjl4oshzn9sm.jpg)

We have internet access in our Bastion Host:

![EC2Connected](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/ctysir8lawrhrzkuhgsj.jpg)

**Creating EC2 Instance in Private Subnet**

Let's go now to the Network Settings Section and Click on Edit to select the options marked

![EC2PrivateNetworkSettings](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/2f9ym9snhpz3usz5mg38.jpg)

**Note**: To Add a layer of extra security, I've only provided access through SSH to Bastion Host Security Group as well added ICMP - IPv4 rule to test connectivity.

![SG-Rules](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/uuehk0fctpbi4xa6uwmf.jpg)

Testing Final Connectivity 

After Created the EC2 Private instance, let's test connectivity through web browser:

![EC2PrivateInstaceConnection](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/chwaiv7y90h9te2cbcst.jpg)

As you can see above, we cannot connect through the internet, this is the expected behavior as we haven't assigned a public ip address to this instance since it will remain private.

Let's test connectivity from our Bastion Host

![ConnectivityOK](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/d9mm4qmd139pjzjeph11.jpg)

As we can see, we're able to ping our private instance though our Bastion Server

Let's try our final test by connecting through SSH from our Bastion Server

Let's create a file which contains our key pair

`vi bastionDemoKey.pem`

Copy the content of the key pair created in AWS

Change Permissions to the file created

`chmod 400 bastionDemoKey.pem`

Now let's try SSH to our EC2 Private Instance

`ssh -i bastionDemoKey.pem ec2-user@172.16.2.10`

We have connectivity!!

![SSHPrivateEC2](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/a2i0ogv5lmouj36xjw66.jpg)

I hope you find this information helpful, if you have any issues, comments or feedback shoot me a comment.

Have a good one community!