I am trying to figure out better ways to practice my computer defense/ infosec skills. If someone was to set up a honeypot (e.g., MHN) on AWS/EC2 server and then try to launch attacks from a local machine against it (e.g., Metasploit) why does the AWS public Public DNS name (hxxp://ec2-xx-xx-xx-xx.us-east-1.compute.amazonaws.com) for the instance translate back to an IPv4 address (x.x.x.x)? When I am launching those attacks from metasploit, am I really launching attacks to all machines that are sitting behind that IP address x.x.x.x vs the ec2-xx-xx-xx....?

1 Answer 1


EC2 uses 1-to-1 nat, so all of the traffic addressed to the public address is forwarded to the private address of the EC2 machine (subject to firewall rules you define). EC2 machines sit behind a firewall provided by AWS called a security group, which will certainly have an effect on your testing.

What you are proposing to do almost certainly violate's the AWS acceptable use policy. They require notification before doing penetration testing.

Have you considered using local virtual machines, such as VMWare or VirtualBox?

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.