title: AWS VPC - Access webapp running in private subnet through bastion host
body: <p>I have this VPC architecture setup in AWS using Terraform:</p>
  
  <ol>
  <li>1 VPC for all environments with 1 Internet Gateway</li>
  <li>VPC in one region</li>
  <li>3 Availability Zones with 1 private subnet and 1 public (utility) subnet for each (total of 6 subnets)</li>
  <li>3 NAT Gateways - one for each utility subnet with 3 Elastic IPs assigned to their network interfaces</li>
  <li>3 EIPs - each associated to network interface of public subnets</li>
  <li>1 Bastion Host (with Public IP associated) to allow SSH access to private EC2 instances</li>
  <li>EC2 Instances (1 master and 1 node in each private subnet)</li>
  <li>1 Elastic Load Balancer across the 3 AZs with the instances within ELB referencing the 3 masters.</li>
  </ol>
  
  <p>I can reach the EC2 instances by SSHing through the bastion host without any issues. I have a simple webapp deployed (let's say a webapp running in a docker container in port 5000) in one of these EC2 instances. Now how do I access this webapp running at port 5000 from my browser? Is it through the public IP of the bastion host? If yes, how does the port forwarding happen to the correct EC2 instance where the webapp is running?</p>
  
  <p>Thanks for your help.</p>
  
  <p>Abdul.</p>