An EC2 instance has a public IP, but ip addr inside the OS shows only a 10.x address. Why?
Show the answer
Say this first
The public address never reaches the instance. The internet gateway does one-to-one NAT: outbound it rewrites the private source to the public IP, inbound it rewrites the public destination back to the private IP. An auto-assigned public IP changes on stop and start; an Elastic IP is a static address you own until you release it. AWS charges for every public IPv4 address, attached or not.
Go deeper
How it works
The instance's ENI has 10.10.0.25. AWS maps 203.0.113.25 to it at the edge. Applications must not
bind to the public address, and anything that embeds its own IP in the payload (SIP, FTP active mode)
needs to be told the public address.
Auto-assigned public IP vs Elastic IP
| Auto-assigned | Elastic IP | |
|---|---|---|
| Lifetime | Released on stop or terminate | Yours until released |
| Move between instances | No | Yes, remap in seconds |
| Use cases | Throwaway or test instances | NAT gateways, allow-listed partners, fixed DNS |
Cost
Since February 2024 AWS charges an hourly fee for every public IPv4 address, in use or idle. That is one more reason to keep servers private behind load balancers and NAT, and to look at IPv6.
Azure and GCP
Same idea: Azure public IP resources attach to a NIC or a load balancer, and GCP external IPs (ephemeral or static) are attached to the VM's access config. The guest OS sees only the internal address in both.
They will ask next
How can the instance find out its own public IP?
From instance metadata (
public-ipv4underhttp://169.254.169.254/latest/meta-data/, with an IMDSv2 token), or by calling an external "what is my IP" service.Can an instance in a private subnet with an Elastic IP be reached?
No. Without an IGW route in its subnet the mapping is useless; replies go to the NAT gateway.
Traps
- Configuring the Elastic IP as a secondary address inside the OS. It breaks nothing only by luck.
- Saying the instance "has" the public IP on its interface.