-2

I have an EC2 server on AWS (Ubuntu 13.04). It's currently running a website on port 80 and I am trying to set up SSL.

Right now it does not seem to be responding at all on port 443.

telnet: Unable to connect to remote host: Connection refused

In the AWS security group I set it to allow connections on port 443. I also believe I modified iptables, but maybe I did that wrong.

When I run:

sudo iptables -L -vn

Here is the output:

Chain INPUT (policy ACCEPT 2706 packets, 1652K bytes)
 pkts bytes target     prot opt in     out     source               destination         
    0     0 ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            tcp spt:443

Chain FORWARD (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination         

Chain OUTPUT (policy ACCEPT 1331 packets, 1583K bytes)
 pkts bytes target     prot opt in     out     source               destination         
 5153  434K ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            tcp dpt:80
    0     0 ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            tcp dpt:443

Here are the results of netstat -tlnp

(Not all processes could be identified, non-owned process info
 will not be shown, you would have to be root to see it all.)
Active Internet connections (only servers)
Proto Recv-Q Send-Q Local Address           Foreign Address         State       PID/Program name
tcp        0      0 127.0.0.1:58890         0.0.0.0:*               LISTEN      10571/myapp
tcp        0      0 0.0.0.0:8080            0.0.0.0:*               LISTEN      5748/           
tcp        0      0 127.0.0.1:49270         0.0.0.0:*               LISTEN      10105/myapp
tcp        0      0 0.0.0.0:22              0.0.0.0:*               LISTEN      -               
tcp        0      0 127.0.0.1:5432          0.0.0.0:*               LISTEN      -               
tcp6       0      0 :::22                   :::*                    LISTEN      -     

Here is my /etc/iptables.rules file:

# Generated by iptables-save v1.4.12 on Sun Oct  6 17:03:14 2013
*nat
:PREROUTING ACCEPT [0:0]
:INPUT ACCEPT [0:0]
:OUTPUT ACCEPT [2:222]
:POSTROUTING ACCEPT [2:222]
-A PREROUTING -i eth0 -p tcp -m tcp --dport 80 -j REDIRECT --to-ports 8080
COMMIT
# Completed on Sun Oct  6 17:03:14 2013

EDIT I updated the iptables configuration:

sudo iptables -L -vn
Chain INPUT (policy ACCEPT 105 packets, 10377 bytes)
 pkts bytes target     prot opt in     out     source               destination         
   21  1260 ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            tcp dpt:443flags: 0x17/0x02
    8   480 ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            tcp dpt:443

Chain FORWARD (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination         

Chain OUTPUT (policy ACCEPT 91 packets, 21519 bytes)
 pkts bytes target     prot opt in     out     source               destination         
14313 1307K ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            tcp dpt:80
    5   200 ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            tcp spt:443
  • 2
    You appear to have the INPUT chain using source port (spt) 443 instead of destination port (dpt) 443. Change that, and try again. – TessellatingHeckler Jul 15 '14 at 15:20
  • 3
    It's not a firewall issue. The rule in INPUT is indeed not sensible, but connection refused means that the port is reachable but not open. Check using netstat -tlnp. Make sure your web server is configured to listen on port 443. – Felix Frank Jul 15 '14 at 15:25
  • @FelixFrank, based on the results of netstat -tlnp (I edited the original question to include the results) it seems that the web server is not configured to listen on port 443. I can work on the nginx configs later. First I want to see if at least iptables is properly configured to allow connections on port 443. Is the proper way to test this via telnet? I want to make sure I don't have any iptables issues before proceeding to mess with the nginx configs. – user2437742 Jul 15 '14 at 16:36
  • @user2437742 in that case, "Connection refused" says that your firewall is fine. What were you expecting? – Felix Frank Jul 15 '14 at 16:39
  • Downvote: Please don't keep asking for ongoing support through editing your question. – Felix Frank Jul 15 '14 at 16:42
0

You mixed up the source and destination port in your iptables configuration. In the Input Chain you have to allow Pakets with the destination port 443. In the Output Chain you must allow Traffic from Port 443.

  • Thanks for the feedback. I have edited the iptables rules. Can you please let me know if the new rules are OK? If not what do I need to do to fix them? – user2437742 Jul 15 '14 at 16:30

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.