0
$\begingroup$

Rosanswers logo

I have ROS Indigo working well on an Amazon EC2 server. I can ping the server OK, although I had to setup the amazon security group to allow that. However, I am unable to get a response to rostopic list.

On the amazon server, if I set ROS_IP to the public IP address, then different terminal windows do not communicate ROS messages, or even see the master, so I have to set ROS_IP to the local IP address.

I tried setting the remote ROS_MASTER_URI to the public IP address (that I can ping OK) and port 11311 but ROS does not respond. rostopic list does not return at all, not even with "unable to find master."

What do I need to do for ROS networking to access the Amazon EC2?


Originally posted by dan on ROS Answers with karma: 875 on 2017-03-14

Post score: 0

$\endgroup$

1 Answer 1

0
$\begingroup$

Rosanswers logo

tl;dr: Don't. Use a VPN instead.

Running a ROS master on a public IP isn't really a good idea, since anyone can discover it and poke around in your system. Someone at Defcon a few years back had a ROS robot on an open network and was inviting people to hack it, and I was able to inspect and take control of it in about 30 minutes.

Instead, I would recommend that you set up a VPC and connect remote clients to it over VPN. I haven't done this much but this guide looks like a good starting point: https://docs.aws.amazon.com/AmazonVPC/latest/UserGuide/vpn-connections.html

EC2's network setup is a bit like being behind a NAT firewall, since the public IP isn't actually bound on the local machine. External nodes need to use one IP and on-machine nodes need to use the local IP, so when I've had to do this I used the machine's hostname in the ROS_MASTER_URI and ROS_HOSTNAME; and then make sure that the DNS record for the hostname resolves to the public IP, and then add an override for it in the EC2 instance's /etc/hosts that resolves to 127.0.0.1


Originally posted by ahendrix with karma: 47576 on 2017-03-15

This answer was ACCEPTED on the original site

Post score: 3


Original comments

Comment by gvdhoorn on 2017-03-15:
re: defcon hacking a ROS robot: at ROSCon16 Ian Chen talked about running Gazebo 'in the cloud'. Part of his talk was to show the current state of gazebo web client, etc. As the GAZEBO_MASTER_URI was visible, attendees started connecting to his gzserver and spawning objects in the simulation ..

Comment by gvdhoorn on 2017-03-15:
.. which was all rather funny, but a good example of why you don't want to do this (video around 12:35). ROS (1) delegates security of your node graph to other systems, and a VPN is a good example of one.

Comment by dan on 2017-03-15:
Thanks for the detailed answer Austin. Those are excellent points. I'm going through the process of setting up a VPN on the AWS EC2 machine.

Comment by dan on 2017-03-15:
Got the VPN working. I can send ROS topics one way but not the other. Running roscore on my local machine, with ROS_MASTER_URI on both the local machine and the amazon machine set to the local machine's VPN IP, all OK. But if the amazon machine is master, the local machine cannot see ROS topics.

Comment by dan on 2017-03-15:
In both cases, I set the local machine's ROS_IP to its VPN IP and the amazon machine's ROS_IP to its VPN IP. They each can ping the other's VPN IP. netcat works if the local machine is the listener, it fails if the amazon machine is the listener.

Comment by ahendrix on 2017-03-15:
It seems like the local machine can't connect to a listening socket on the amazon server. Perhaps the listening process on the amazon machine is binding to an IP instead of listening on all addresses; netstat -tlp will show the address that each listening port/process is bound to.

Comment by dan on 2017-03-16:
I tried putting the VPN server on my local machine and making the amazon machine the client. The VPN works, I can ping, but netcat fails when the amazon machine listens, same as before. I tried netstat and got lines of results, mostly localhost:port_number. I don't know how to interpret that.

Comment by dan on 2017-03-16:
A bit more data. With the VPN, I can ping the VPN IPs (10.8.0.1 host, 10.8.0.6 client) from both machines. I can ping the amazon machine local IP address (172.31...) from my machine. However, the amazon machine cannot ping my local IP address (192.168....) , it can ping only the VPN IP (10.8.0.6)

Comment by dan on 2017-03-16:
It's all working now. It boiled down to opening up the Amazon security groups, plus using the VPN IPs for the ROS_IP and ROS_MASTER_URI values.

$\endgroup$

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.