6

My EC2 instance is blocking all outbound connections.

wget http://www.google.com  ==> Hangs
ping google.com ==>hangs
ssh user@anyserver ==>hangs

I ran : sudo iptables -F to eliminate all rules to no avail

AWS Management console shows Security Group for that instance has Inbound rule allowing ssh and port 80. Can't find anything about Outbound rules there.

Rebooted instance, no change.

If anyone knows how to diagnose or fix, please help.

Adding info:

[ec2-user@ip-10-112-62-73 ~]$ ifconfig
eth0      Link encap:Ethernet  HWaddr 12:31:3D:06:31:BB  
          inet addr:10.112.62.73  Bcast:10.112.63.255  Mask:255.255.254.0
          inet6 addr: fe80::1031:3dff:fe06:31bb/64 Scope:Link
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:1933 errors:0 dropped:0 overruns:0 frame:0
          TX packets:1764 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000 
          RX bytes:164075 (160.2 KiB)  TX bytes:343256 (335.2 KiB)
          Interrupt:9 

lo        Link encap:Local Loopback  
          inet addr:127.0.0.1  Mask:255.0.0.0
          inet6 addr: ::1/128 Scope:Host
          UP LOOPBACK RUNNING  MTU:16436  Metric:1
          RX packets:8 errors:0 dropped:0 overruns:0 frame:0
          TX packets:8 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0 
          RX bytes:672 (672.0 b)  TX bytes:672 (672.0 b)


[ec2-user@ip-10-112-62-73 ~]$ ip route show
10.112.62.0/23 dev eth0  proto kernel  scope link  src 10.112.62.73 
default via 10.112.62.1 dev eth0 
14
  • What if you ping 8.8.8.8? Where are your DNS servers? Apr 5, 2012 at 16:42
  • 1
    ping 8.8.8.8 ==> Hangs
    – Fraggle
    Apr 5, 2012 at 16:45
  • Public DNS (from AWS Console): ec2-174-129-153-180.compute-1.amazonaws.com
    – Fraggle
    Apr 5, 2012 at 16:46
  • Private DNS: ip-10-112-62-73.ec2.internal
    – Fraggle
    Apr 5, 2012 at 16:46
  • log entries for your NIC? iptables -L? Apr 5, 2012 at 16:48

3 Answers 3

3

I just resolved this issue on my EC2 instance. I had to update the security group configuration, adding:

  1. An Outbound rule for all HTTP TCP traffic on port 80, from destination 0.0.0.0/0
  2. An Outbound rule for all HTTPS TCP traffic on port 443, from destination 0.0.0.0/0

I probably removed these accidentally while troubleshooting a different problem.

2
  • 1
    Even if I add these, there's always an EC2 outbound rule (which I cannot seem to edit) that shows 0.0.0.0/0 to be DENY for "all traffic". How is that managed?
    – PKHunter
    Oct 10, 2015 at 3:08
  • 1
    That rule is fixed by Amazon and cannot be edited. It's a fail-safe rule. Nov 9, 2015 at 16:44
1

Coming from the future: If you are having the same issue but you are sure that you have the correct security configuration, just detach the security group from the instance, and reattach it.

2
  • You can't just detach security group, one thing need to be attached each time. Anyway juggling groups didn't work for me.
    – Suor
    May 29, 2017 at 8:44
  • This was my issue. Even though I updated the rules, for some reason they weren't being applied. Removing and re-adding the security group did the trick.
    – eugene
    Jun 29, 2020 at 6:10
0

I finally solved the problem by dis-associating the elastic ip and then re-associating it.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .