0

My security group settings are accurate. I have tried adding the specific ip address that I am trying to connect from and also connections from all ip addresses (0.0.0.0/0), but my connection attempts get filtered. I can connect from other ip addresses without a problem when adding them to the security group.

The problem is not unique to a single instance. I've created new instances which also only deny access from this particular ip address. The problem does seem unique to SSH port 22, however. I can connect from this particular ip address on port 443 and when pinging through ICMP ports.

Please, can anyone make some suggestions as to where the problem might be?

UPDATE: I tried running nmap

From ip address I CANNOT SSH from:

$ nmap -Pn -p22 <instance ip>
Host is up.
PORT   STATE    SERVICE
22/tcp filtered ssh

$ nmap -Pn <instance ip>
Host is up (0.014s latency).
Not shown: 996 filtered ports
PORT     STATE SERVICE
21/tcp   open  ftp
443/tcp  open  https
554/tcp  open  rtsp
7070/tcp open  realserver

The only ports I have open in my security group for this ip address are 443 and 22, so I am not sure why 21, 554 and 7070 are open.

And from ip address I can SSH from:

> nmap -Pn <instance ip>

Host is up (0.014s latency).
Not shown: 998 filtered ports
PORT     STATE SERVICE
22/tcp   open  ssh
443/tcp  open  https

I found this on stackoverflow where somebody testing with nmap had similar issue. I tried creating all kinds of new instances -- with the same AMI, a different AMI, different availability zone, different security group -- with no luck.

  • whatismyipaddress.com – Garreth McDaid Sep 15 '14 at 16:35
  • @Garreth Right. This is the address I'm making sure is allowed to connect, but it doesn't connect. – Kevin Sep 15 '14 at 20:18
  • Are you sure the sshd daemon is started? Did the instance previously have an elastic ip address which has since become detached? – Garreth McDaid Sep 15 '14 at 22:23
  • @Garreth I don't have any elastic ip addresses and since this issue has started I have successfully SSH'ed into the instance from two different sites, from my remote Windows server at work using Putty and from Starbucks using the same Mac Terminal I am unable to connect with from the ip address in question. – Kevin Sep 15 '14 at 22:40
0

This sounds much like a firewall issue that is dropping packets with destination port 22. You can test this theory by modifying /etc/ssh/sshd_config with:

Port 443

Turn off your webserver before you restart ssh. And make sure you have another session open. Just incase :P

As you say you can connect to port 443, and ICMP. Check with your network admin or take another look at your Security Group. (We all accidentaly type the wrong IP from time to time. It happens, we are not infallible)

  • Thanks. Connecting with SSH on 443 worked. I've ensured my settings don't have a typo. It's actually hard to mess up b/c they auto-fill the ip address for you when selecting "My IP" from the option menu. – Kevin Sep 18 '14 at 3:19
  • Glad this worked. Then it is definitely your network firewall. (Agreed on AWS, Very simple) – ticoombs Sep 18 '14 at 4:30

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.