2

I'm new to EC2 and I'm pretty confused about what's going on. I have a security group setup that allows world access on a number of ports (22,25,80,443,993) all with source 0.0.0.0/0

I have my services listening on those ports

netstat -tNl
Active Internet connections (only servers)
Proto Recv-Q Send-Q Local Address           Foreign Address         State      
tcp        0      0 0.0.0.0:ssh             0.0.0.0:*               LISTEN     
tcp        0      0 0.0.0.0:imaps           0.0.0.0:*               LISTEN     
tcp        0      0 0.0.0.0:pop3s           0.0.0.0:*               LISTEN     
tcp        0      0 0.0.0.0:pop3            0.0.0.0:*               LISTEN     
tcp        0      0 0.0.0.0:imap2           0.0.0.0:*               LISTEN     
tcp6       0      0 :::ssh                  :::*                    LISTEN     
tcp6       0      0 :::smtp                 :::*                    LISTEN     
tcp6       0      0 :::imaps                :::*                    LISTEN     
tcp6       0      0 :::pop3s                :::*                    LISTEN     
tcp6       0      0 :::pop3                 :::*                    LISTEN     
tcp6       0      0 :::imap2                :::*                    LISTEN     
tcp6       0      0 :::http                 :::*                    LISTEN

I can telnet to it on the local adapter

telnet 172.31.55.38 25
Trying 172.31.55.38...
Connected to 172.31.55.38.
Escape character is '^]'.
220 example.org ESMTP

and I don't have any iptable rules that should be causing problems

iptables -L
Chain INPUT (policy ACCEPT)
target     prot opt source               destination         

Chain FORWARD (policy ACCEPT)
target     prot opt source               destination         

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination

I'm at a loss on what it could be. any help would be appreciated.

5
  • 4
    Fire up another EC2 instance temporarily and test from there (or from some other VPS). It's highly likely that your ISP is blocking TCP port 25.
    – EEAA
    Dec 17, 2015 at 22:26
  • What exactly happens / what error messages do you get if you telnet to port 25 from where you cannot connect ?
    – user9517
    Dec 17, 2015 at 22:32
  • 2
    Check the inbound rules on the ACL attached to your VPC.
    – joeqwerty
    Dec 17, 2015 at 22:32
  • 1
    sheesh you're correct. never had this before. but just moved.
    – spotter
    Dec 17, 2015 at 22:33
  • How did you solve this @spotter? I have the exact same issue
    – hfossli
    Jan 19, 2021 at 23:56

2 Answers 2

5

Almost all residential ISPs, and almost all public WiFi hotspots, block outbound access on port 25. This is largely because approximately one-third of the world's computers are infected with malware, and one of the most popular ways to monetize malware is to send spam from infected computers.

ISPs obviously don't want to deal with complaints about spam originating from 30% of their IP addresses, so blocking port 25 outbound is the only sensible thing for them to do.

If you really need to connect to port 25 on your instance, just open a different port to your EC2 instance (e.g. port 2525) and then forward the port using iptables.

Or, if you desire to make this a little bit more complicated, you can use netcat or ssh to achieve a similar result.

6
  • 1
    Some ISPs intercept port 25 and divert the traffic to their own SMTP server. But blocking it is pretty common as well. Now if only they would all implement BCP38... Dec 17, 2015 at 23:18
  • I struggle to imagine why ISPs are still operating SMTP servers in 2015. Perhaps to help us identify users who are very old and/or marginally computer literate.
    – Skyhawk
    Dec 17, 2015 at 23:20
  • I never had this issue w/ TWC in NY, but live and learn. The issue was a physical box I had hosted at my old university for mail and the like hard drive kicked the bucket after about 9 years (smartctl says 79097 power on hours). And I had to scramble to get a new box up to avoid lost mail as with the move mentioned above no longer had physical access to it.
    – spotter
    Dec 17, 2015 at 23:28
  • Because ISPs still provide email accounts along with Internet connectivity? Dec 17, 2015 at 23:30
  • @MichaelHampton But why? That was a perfectly sensible thing to do from the 1990s until Gmail exited beta status in 2009. Are ISP e-mail accounts still used by more than 5% of customers?
    – Skyhawk
    Dec 17, 2015 at 23:36
0

The answer was to check the ACL rules on the VPC. Credit to joeqwerty in the comments of the original question

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .