0

I have spun up an Amazon EC2 instance, and I'm trying to connect to it via SSH from a Mac.

$ ls | grep 'pem'
AWSKeyPair1.pem
$ ssh -vvv -i AWSKeyPair1.pem ec2-user@54.210.10.190
OpenSSH_6.2p2, OpenSSL 0.9.8zf 19 Mar 2015
debug1: Reading configuration data /Users/jackjack/.ssh/config
debug1: /Users/jackjack/.ssh/config line 1: Applying options for *
debug1: Reading configuration data /usr/local/etc/ssh_config
debug1: /usr/local/etc/ssh_config line 20: Applying options for *
debug1: /usr/local/etc/ssh_config line 102: Applying options for *
debug2: ssh_connect: needpriv 0
debug1: Connecting to 54.210.10.190 [54.210.10.190] port 22.
debug1: connect to address 54.210.10.190 port 22: Operation timed out
ssh: connect to host 54.210.10.190 port 22: Operation timed out

According to this troubleshooting guide, I should check my security rules. I've confirmed that all my Security Groups allow all traffic to and from any source ("0.0.0.0/0").

I don't understand the second and third points in that guide, though. None of the options on the EC2 dashboard mention VPC or ACL - how do I check those settings?

What's more, the instance doesn't even respond to ping:

$ ping 54.210.10.190
PING 54.210.10.190 (54.210.10.190): 56 data bytes
Request timeout for icmp_seq 0
Request timeout for icmp_seq 1
Request timeout for icmp_seq 2
Request timeout for icmp_seq 3
Request timeout for icmp_seq 4
Request timeout for icmp_seq 5
Request timeout for icmp_seq 6
Request timeout for icmp_seq 7
Request timeout for icmp_seq 8
...

I've already tried shutting down the instance and starting a new one - same result.

EDIT: Added System Log - http://cryptb.in/lFDJTHdo4W

|improve this question|||||
  • 1
    Security Groups allow all traffic to and from any source ("0.0.0.0/0"). what kind of protocol configured to that rule? Ping happens through ICMP – Anatoly Jul 13 '15 at 10:36
  • All but one of them were set to "All Traffic" (e.g. here) - the exception was one with the description "default group" (not "default VPC security group", like the others), which didn't have the "All Traffic" option in the dropdown - I set that to accept TCP, UDP, and ICMP (here) – scubbo Jul 13 '15 at 11:45
2

Working from the bottom up, layer three would be VPC subnets and routing along with your own local routing. For routing in a VPC, check your subnet routing tables. For an instance to be routable by a public IP address, the instance needs to route to the VPC Internet Gateway which will maintain a 1:1 mapping of the public IP address and the internal private IP address for traffic going and traffic going out of the VPC.

For layer 4 (transport) issues there may be a problem with your security group inbound rules, the VPC Subnet ACL, and lastly local firewalls. Another possibility is an intermediary carrier is dropping ICMP as they apt to do from time-to-time for QoS reasons.

Working from the inside out, if you can ping other sites such as www.google.com and get a response, it's unlikely your network is the problem. If you can't ping www.google.com at all, then the problem is probably very close to you. If you can ping www.google.com, check your security group rules allow ICMP, check VPC Subnet permits ICMP, and also double-check your instance firewall as it's possible you're dropping the ICMP packets with IPTables (or something similar).

That you can SSH is a good sign, because at least we know you can route to your instance.

|improve this answer|||||
  • OK, I found the VPC Dashboard (am I stupid or is it not linked anywhere from here?). I've deleted the various unused VPC's and Subnets that were hanging around (presumably from previous attempts/restarts) and I'm left with just the VPC and subnet that my instance is in. I'll check the ACLs against here and see what I can see... – scubbo Jul 13 '15 at 12:46
  • The subnet's ACL seems to allow all traffic. The main routing table has a single route - 172.30.0.0/16 to "local". When I tried to add a route, the only available target was "igw-29430e4c" (screenshot), which I guess is an Internet Gateway of some kind. I added the route, saved, retried the SSH, and I'm in! (cont.) – scubbo Jul 13 '15 at 13:07
  • (cont.) So, I can ssh in now, which is great - but I'm still confused about what went wrong. Is there a simple explanation for why routing for EC2 instances isn't configured by default? Thanks for your help! – scubbo Jul 13 '15 at 13:08
  • I'm glad you stumbled across it, but my explanation was more abut being thorough. If you had no route other than for the VPC, the traffic would hit the public IP address, be NATed to the private IP address and hit your instance. The instance would then have no way to route the response back. It's probable you were getting the initial SYN packet for the SSH connection to the instance, but the routing back to your workstation was missing. If I understand what you're saying. – Jason Jul 13 '15 at 13:14
  • OK - I think I understand. Or at least I know what to Google to understand more. Still pretty new to networking on any level more complex than "Domain Names map to IP Addresses point to machines" (all of which is probably a gross over-simplification/flat-out wrong! :) ). Time to hit the books! Thanks for your guidance. Much appreciated. – scubbo Jul 13 '15 at 13:46

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.