1 Answers
Because you don’t allow external/public traffic from outside the network to your backend instances, you can’t connect to the external IP. When SSH’d onto a frontend server, you use the internal IP which is on your "local" network because you’ve only allowed traffic that way and not via the public web.
i think its normal, because you are trying the connection within internal VPC and External IPs are used to connect from outside. In this case backend servers dont have rule to go out of VPC.