Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

My EC2 instance is blocking all outbound connections.

wget  ==> Hangs
ping ==>hangs
ssh user@anyserver ==>hangs

I ran : sudo iptables -F to eliminate all rules to no avail

AWS Management console shows Security Group for that instance has Inbound rule allowing ssh and port 80. Can't find anything about Outbound rules there.

Rebooted instance, no change.

If anyone knows how to diagnose or fix, please help.

Adding info:

[ec2-user@ip-10-112-62-73 ~]$ ifconfig
eth0      Link encap:Ethernet  HWaddr 12:31:3D:06:31:BB  
          inet addr:  Bcast:  Mask:
          inet6 addr: fe80::1031:3dff:fe06:31bb/64 Scope:Link
          RX packets:1933 errors:0 dropped:0 overruns:0 frame:0
          TX packets:1764 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000 
          RX bytes:164075 (160.2 KiB)  TX bytes:343256 (335.2 KiB)

lo        Link encap:Local Loopback  
          inet addr:  Mask:
          inet6 addr: ::1/128 Scope:Host
          UP LOOPBACK RUNNING  MTU:16436  Metric:1
          RX packets:8 errors:0 dropped:0 overruns:0 frame:0
          TX packets:8 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0 
          RX bytes:672 (672.0 b)  TX bytes:672 (672.0 b)

[ec2-user@ip-10-112-62-73 ~]$ ip route show dev eth0  proto kernel  scope link  src 
default via dev eth0 
share|improve this question
What if you ping Where are your DNS servers? – SmallClanger Apr 5 '12 at 16:42
ping ==> Hangs – Fraggle Apr 5 '12 at 16:45
Public DNS (from AWS Console): – Fraggle Apr 5 '12 at 16:46
Private DNS: ip-10-112-62-73.ec2.internal – Fraggle Apr 5 '12 at 16:46
log entries for your NIC? iptables -L? – Bart Silverstrim Apr 5 '12 at 16:48

I just resolved this issue on my EC2 instance. I had to update the security group configuration, adding:

  1. An Outbound rule for all HTTP TCP traffic on port 80, from destination
  2. An Outbound rule for all HTTPS TCP traffic on port 443, from destination

I probably removed these accidentally while troubleshooting a different problem.

share|improve this answer
Even if I add these, there's always an EC2 outbound rule (which I cannot seem to edit) that shows to be DENY for "all traffic". How is that managed? – PKHunter Oct 10 '15 at 3:08
That rule is fixed by Amazon and cannot be edited. It's a fail-safe rule. – Michael Johnson Nov 9 '15 at 16:44

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.