I am trying to figure out better ways to practice my computer defense/ infosec skills. If someone was to set up a honeypot (e.g., MHN) on AWS/EC2 server and then try to launch attacks from a local machine against it (e.g., Metasploit) why does the AWS public Public DNS name (hxxp://ec2-xx-xx-xx-xx.us-east-1.compute.amazonaws.com) for the instance translate back to an IPv4 address (x.x.x.x)? When I am launching those attacks from metasploit, am I really launching attacks to all machines that are sitting behind that IP address x.x.x.x vs the ec2-xx-xx-xx....?

1 Answer 1


EC2 uses 1-to-1 nat, so all of the traffic addressed to the public address is forwarded to the private address of the EC2 machine (subject to firewall rules you define). EC2 machines sit behind a firewall provided by AWS called a security group, which will certainly have an effect on your testing.

What you are proposing to do almost certainly violate's the AWS acceptable use policy. They require notification before doing penetration testing. [2022 edit, you actually can test your own EC2 instances, but do not attack AWS infrastructure https://aws.amazon.com/security/penetration-testing/]

Have you considered using local virtual machines, such as VMWare or VirtualBox?

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .