Can't connect to public IP for EC2 instance

Question

I have an EC2 instance which is running with the following security groups:

HTTP - TCP - 80 - 0.0.0.0/0
Custom UDP Rule - UDP - 1194 - 0.0.0.0/0
SSH - TCP - 22 - 0.0.0.0/0
Custom TCP Rule - TCP - 943 - 0.0.0.0/0
HTTPS - TCP - 443 - 0.0.0.0/0

However, when I try to access http://{PUBLIC_IP} or https://{PUBLIC_IP} in the browser, I get a "{IP} refused to connect" error. I'm new to AWS. Am I missing something here? What should I do to debug?

Answer 1

One way to debug this particular class of problem is to use netcat in order to determine where the problem lies.

If you run netcat against port 80 on the public IP address of your instance and just get a hang (no output at all), then most likely your security group isn't allowing traffic through. Here is an example from an EC2 instance that is in a security group that doesn't allow port 80 traffic inbound:

% nc -v 55.35.300.45 80
<just hangs>

Whereas if the security group is changed to allow port 80, but the EC2 instance doesn't have any process listening on port 80, you'll get the following:

% nc -v 55.35.300.45 80
nc: connectx to 52.38.300.43 port 80 (tcp) failed: Connection refused

Given that your browser gave you a similar "connection refused", most likely the problem is that there is no web server running on your instance. You can verify this by ssh'ing into the instance and seeing if you can connect to port 80 there:

ssh [email protected]
% nc -v localhost 80
nc: connect to localhost port 80 (tcp) failed: Connection refused

If you get something like the above, you're definitely not running a webserver.

Answer 2

I'm not sure if it's too late to help but I was stuck with a similar issue with my test server

SG Inbound: ssh -> 22
            HTTP -> 80

NACL: default allow/deny settings

but still couldn't ping to the server from my browser, then I realize there's nothing running on the server that can serve the request, and I started httpd server (webserver) and it worked.

sudo yum -y install httpd
sudo service httpd start

this way you can test the connectivity if you are playing with SGs and NACLs and of course it's not the only way, just an example if you're figuring your System N/W out.

Answer 3

Have you installed webserver(ngingx/apache) to serve your requests. If so please share your the config files. (So that it will help to troubleshoot)

Answer 4

I think the reason is probably that you did not set up a web server for your EC2 instance, because if you try to access http://{PUBLIC_IP} or https://{PUBLIC_IP}, you need to have a background server to serve the http request as @Niranj Rajasekaran said.

By the way, by simply pinging the {PUBLIC_IP}, you could see if your connection to your EC2 instance is normal or not.

In command prompt or terminal, type

ping {PUBLIC_IP}

Answer 5

In my case, the server was running but available on just 127.0.0.1 so it refused connections from external hosts. To see if this is your situation, you can run

 netstat -an | grep <port number>

If it says 127.0.0.1:<port number> instead of 0.0.0.0:<port number>, you have this problem.

Usually there's a flag or an argument in your server code somewhere to set the host to 0.0.0.0:

app.run(host='0.0.0.0') # flask example

However, in my case, I had already set this so I thought that couldn't possibly be the issue, which is how I ended up on this thread, which asks more generally about the problem. Unfortunately, I was using docker, and had set 0.0.0.0 on the container but was mapping that explicitly to 127.0.0.1 on the host in the docker-compose port-mapping:

        ports:
            - "127.0.0.1:<port number>:<port number>"

Changing that line to remove the host IP specification fixed the problem upon re-deploy:

        ports:
            - "<port number>:<port number>"