Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Got a noob question about security settings on AWS ec2 instance. I've set up an instance with Tocat7 ( ami-95da17fc ) and I have a little issue.

If I ssh into the instance and do ping -c 2 -p 80 localhost I get 0 packet loss if I ping my elastic ip I get 100% pocket loss, same thing with the

if I simply try to ping the site from terminal (not logged into the instance) I also get 100% pocket loss.

My default security group has the following settings:

0 - 65535 sg-07787e6e (default)

80 (HTTP)

8080 (HTTP*)

22 (SSH)

I'd be most grateful if anyone can shed some light on what I'm missing.

share|improve this question
up vote 2 down vote accepted

Ping uses the ICMP protocol - the security groups in AWS Console default to the TCP protocol. If you wish to be able to ping your instance from 'the outside', you need change the security group settings to permit the ICMP protocol (Echo), using, for instance, something like the following:

ec2-authorize default -P icmp -t -1:-1 -s

You can also use the AWS Console to accomplish this:

  • Create a 'Custom ICMP Rule' for your security group
  • Type: Echo Request and Type: Echo Reply (both are required)
  • Source:

Alternatively, for the same effect as the ec2-authorize command above, you can allow 'All ICMP'

See the AWS EC2 Docs for more information, and the AWS FAQ.

share|improve this answer
to follow up, is this in any way related why I can't see index.html placed in /var/www/html/ from the outside? – vector Oct 6 '11 at 2:05
It shouldn't be - if you have a web server running on port 80, and port 80 is open in your security group, you should be able to access the page from the outside. Ensure your web server is running on port 80 with netstat, and use curl to retrieve the page from the instance (i.e. to rule out security group issues). Also check your iptables rules if you have changed them. – cyberx86 Oct 6 '11 at 2:09
... checked with netstat and curl, posted in answer form for readability. – vector Oct 6 '11 at 2:40

... hm, I get 404 with curl, sudo netstat -lp gives me:

Active Internet connections (only servers) Proto Recv-Q Send-Q Local Address Foreign Address State PID/Program name
tcp 0 0 *:ssh : LISTEN 841/sshd
tcp 0 0 localhost:smtp : LISTEN 868/sendmail: accep tcp 0 0 *:webcache : LISTEN 981/java
tcp 0 0 *:http : LISTEN 948/httpd
tcp 0 0 *:ssh : LISTEN 841/sshd
tcp 0 0 localhost:8005 : LISTEN 981/java
tcp 0 0 *:8009 : LISTEN 981/java
udp 0 0 *:bootpc : 734/dhclient
udp 0 0 domU-12-31-39-09-A6:ntp : 852/ntpd
udp 0 0 localhost:ntp : 852/ntpd
udp 0 0 *:ntp : 852/ntpd
udp 0 0 fe80::1031:39ff:fe0:ntp : 852/ntpd
udp 0 0 localhost:ntp : 852/ntpd
udp 0 0 *:ntp : 852/ntpd
Active UNIX domain sockets (only servers) Proto RefCnt Flags Type State I-Node PID/Program name Path unix 2 [ ACC ] STREAM LISTENING 1954 922/gam_server @/tmp/fam-root- unix 2 [ ACC ] STREAM LISTENING 1967 927/bluepilld: host /var/bluepill/socks/hostmanager.sock

... and I've not changed anything in iptables

share|improve this answer
With the given info, it seems that your web server is incorrectly configured (e.g. your documentroot doesn't match the location of your files or your index directive is set wrong, etc.). Netstat says your port 80 is open and 404 is a web-server error (implying you got through to the server). I don't believe you typically get a 404 error if the host is unreachable. (Just for the sake of completeness though (shouldn't matter given the 404), I presume you ran curl against localhost and not your domain name to bypass the security group? curl --header "Host:" --head localhost:80 – cyberx86 Oct 6 '11 at 3:10
no joy: curl --header "Host:" --head localhost:80 HTTP/1.1 404 Not Found Date: Thu, 06 Oct 2011 03:16:18 GMT Server: Apache-Coyote/1.1 Connection: close Content-Type: text/plain; charset=UTF-8 – vector Oct 6 '11 at 3:17
... found the httpd.conf file in /etc/httpd/conf and document root is set to /var/www/html where I put the index.html, sigh.... – vector Oct 6 '11 at 3:28
Those headers suggest you are getting through to the server. Check your error logs - the 404 requests should be listed there - and they may provide more clues to your problem. I am not familiar with Apache-Coyote, so can't offer much guidance on that front. The 'Host' header is for virtual hosts - if you aren't using those, it can be omitted (if you are using virtual hosts, you will want to check their actual names). I would suggest that you ask a new question if you can't find the problem after looking at your logs. Include the diagnostics you have done and the relevant portions of your logs. – cyberx86 Oct 6 '11 at 3:29
.. will do, thanks. – vector Oct 6 '11 at 3:35

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.