I have an EC2 instance on a security group that allows ports 80, 443 and 22 (tcp, inbound from 0.0.0.0/0 and ::/0); and every outbound connection (to 0.0.0.0/0 & ::/0, all tcp & udp).
I've recently set up a mail server, so I've added port 25/tcp from 0.0.0.0/0 and ::/0 as well.
Now I can connect to my mail server from any external hosts using the public ip as expected, no issues there.
I can also connect from within the instance using
localhost as hostname or 127.0.0.1 as ip.
But I am unable to connect to the instance on port 25 from within the instance using its public ip or hostname. I don't get a connection refused or anything, just a timeout.
I do not have this issue with any of the other open ports in the instance, I can perfectly telnet to port 80, 443 or 22 using the public ip within the instance shell.
I've tried rebooting, stop/start, and even creating a new security group from scratch and switching the instance to it. Still the same result: External connections OK, internal connection using public ip fails only on that port.
iptables looks fine, I see no restrictions or permissions that would affect this port and not the others.
no firewall is enabled on this instance (Debian buster)
mail server is postfix (I do not know if that makes any difference. If it is in fact a postfix config issue I am baffled that I cannot see anything on server logs and it is allowing every other connection source...)