AWS EC2 Ubuntu实例安装Docker后出站网络连接异常求助
我有一台运行10余年的小型AWS EC2 Ubuntu实例，此前入站、出站连接均正常。突然执行sudo apt update时无法连接软件源，报错：
Cannot initiate the connection to eu-west-1.ec2.archive.ubuntu.com:80 (2a05:d018:fd:f302:55ec:6d1c:c751:1067). - connect (101: Network is unreachable)
因该实例为Ubuntu 16旧版本，我创建了一台搭载Ubuntu 24的新EC2实例。初始状态一切正常，但安装Docker后故障重现：无法通过wget访问外部资源，请求超时卡住：
wget http://google.com/
Resolving google.com (google.com)... 172.253.116.113, 172.253.116.138, 172.253.116.139, ...
Connecting to google.com (google.com)|172.253.116.113|:80... ^C
执行apt update时的报错：
Failed to fetch https://download.docker.com/linux/ubuntu/dists/noble/InRelease Cannot initiate the connection to download.docker.com:443 (2600:9000:265e:0:3:db06:4200:93a1). - connect (101: Network is unreachable)
入站连接（如SSH）正常，AWS控制台安全组出站规则已允许所有流量：
All All 0.0.0.0/0
故障明确出现在安装Docker之后，我本地Ubuntu 20服务器按相同步骤安装Docker后运行正常。怀疑路由表异常，但无法安装netstat等工具，仅收集到以下信息：
iptables 输出
sudo iptables -L -v -n Chain INPUT (policy ACCEPT 0 packets, 0 bytes) pkts bytes target prot opt in out source destination Chain FORWARD (policy ACCEPT 0 packets, 0 bytes) pkts bytes target prot opt in out source destination 0 0 DOCKER-USER 0 -- * * 0.0.0.0/0 0.0.0.0/0 0 0 DOCKER-ISOLATION-STAGE-1 0 -- * * 0.0.0.0/0 0.0.0.0/0 0 0 ACCEPT 0 -- * docker0 0.0.0.0/0 0.0.0.0/0 ctstate RELATED,ESTABLISHED 0 0 DOCKER 0 -- * docker0 0.0.0.0/0 0.0.0.0/0 0 0 ACCEPT 0 -- docker0 !docker0 0.0.0.0/0 0.0.0.0/0 0 0 ACCEPT 0 -- docker0 docker0 0.0.0.0/0 0.0.0.0/0 Chain OUTPUT (policy ACCEPT 0 packets, 0 bytes) pkts bytes target prot opt in out source destination Chain DOCKER (1 references) pkts bytes target prot opt in out source destination Chain DOCKER-ISOLATION-STAGE-1 (1 references) pkts bytes target prot opt in out source destination 0 0 DOCKER-ISOLATION-STAGE-2 0 -- docker0 !docker0 0.0.0.0/0 0.0.0.0/0 0 0 RETURN 0 -- * * 0.0.0.0/0 0.0.0.0/0 Chain DOCKER-ISOLATION-STAGE-2 (1 references) pkts bytes target prot opt in out source destination 0 0 DROP 0 -- * docker0 0.0.0.0/0 0.0.0.0/0 0 0 RETURN 0 -- * * 0.0.0.0/0 0.0.0.0/0 Chain DOCKER-USER (1 references) pkts bytes target prot opt in out source destination 0 0 RETURN 0 -- * * 0.0.0.0/0 0.0.0.0/0
路由表输出
ip route default via 172.31.32.1 dev enX0 proto dhcp src 172.31.35.63 metric 100 172.31.0.2 via 172.31.32.1 dev enX0 proto dhcp src 172.31.35.63 metric 100 172.31.32.0/20 dev enX0 proto kernel scope link src 172.31.35.63 metric 100 172.31.32.1 dev enX0 proto dhcp scope link src 172.31.35.63 metric 100 192.168.1.0/24 dev docker0 proto kernel scope link src 192.168.1.1 linkdown
curl 调试输出
curl -v http://google.com * Host google.com:80 was resolved. * IPv6: 2a00:1450:400b:c02::65, 2a00:1450:400b:c02::8b, 2a00:1450:400b:c02::8a, 2a00:1450:400b:c02::71 * IPv4: 209.85.203.139, 209.85.203.100, 209.85.203.102, 209.85.203.101, 209.85.203.138, 209.85.203.113 * Trying 209.85.203.139:80... * Trying [2a00:1450:400b:c02::65]:80... * Immediate connect fail for 2a00:1450:400b:c02::65: Network is unreachable * Trying [2a00:1450:400b:c02::8b]:80... * Immediate connect fail for 2a00:1450:400b:c02::8b: Network is unreachable
总结：运行10年无异常的老实例突发出站故障，新实例安装Docker后同样出现问题，请求提供解决建议。
内容的提问来源于stack exchange，提问作者Oleksii Pylypchuk
