I'm running an EC2 server with Ubuntu 14.04 & apache, and I have an app that uses the Ratchet websocket plugin for CakePHP. I have this working fine on localhost and I wanted to test the app on a server. When I SSH into my server and launch the shell script it runs fine. However, when I actually go to the page that uses the websocket connection, in the network tab on chrome it shows websocket(pending), and then it fails with the following error

WebSocket connection to 'ws://my.ip.address:8080/websocket' failed: Error in connection establishment: net::ERR_CONNECTION_TIMED_OUT

I used telnet my.server.ip.address 80 and successfully connected. I was also able to connect to port 22, but promplty kicked off due to "protocol mismatch". I tried the same thing but on port 8080 and got a connection timeout.

I was able to connect to port 8080 by ssh'ing into my server and using telnet 8080. I cannot do this from an outside computer, only from the local address from an SSH connection. I used sudo tcpdump -i any port 8080 in a separte terminal that I was connected in via SSH, and the traffic of my telnet connection showed. So, I believe port 8080 is open and I can connect from the inside, but despite what UFW shows, all outside traffic to port 8080 appears to be blocked.

When developing on localhost, if I forget to enable the websocket server I get that same connection timeout error.

When I use nmap -p 8080 my.server.ip.address it shows the state as filtered. When I do the same for port 80 it shows state as open.

On my server I started the websocket and then In terminal I used netstat -ntlp | grep LISTEN which indeed shows port 8080 is listening.

tcp        0      0  *               LISTEN      3532/php      

When I stop the websocket and run the netstat command again, it goes away

On my local machine (which the websocket works on) I opened another terminal and used sudo tcpdump -i any port 8080 to monitor the live traffic. I opened my web browser and sure enough, all of the traffic through the websocket was captured. I did the same exact thing on my server and there was no activity displayed.

After some searching I found someone on the Ratchet Plugin github issue page who seemed to have a similar problem. The plugin's creator responded Hey, regarding your first comment is that if you pass it through a webserver you have to set it up to proxy the websocket connections to Ratchet., but I'm not quite sure what that means. Is that in reference to a port listening, or does it mean something else?

Here is my UFW status

To                         Action      From
--                         ------      ----
22/tcp                     ALLOW       Anywhere
2222/tcp                   ALLOW       Anywhere
80/tcp                     ALLOW       Anywhere
8080/tcp                   ALLOW       Anywhere
22/tcp (v6)                ALLOW       Anywhere (v6)
2222/tcp (v6)              ALLOW       Anywhere (v6)
80/tcp (v6)                ALLOW       Anywhere (v6)
8080/tcp (v6)              ALLOW       Anywhere (v6)
  • Could it be as simple as your firewall? – Eddie Dunn Sep 10 '15 at 0:45
  • I don't think so, but I'm not a server guru so that's a possibility. I'll update my response with what UFW shows – user1104854 Sep 10 '15 at 0:46

Take a look at following:

  • It's not a VPC instance so I can't select a security group now. Do I need to relaunch the server? – user1104854 Sep 10 '15 at 20:29
  • each instance has it's own security group, you should tweak it according to your needs (first link explains how to do it on non-VPC instances, and second link is for VPC instance). – alexus Sep 10 '15 at 20:31
  • That was it! I accepted your answer because you provided the links and gave more detail on how to go about changing the groups. Thanks again. – user1104854 Sep 10 '15 at 20:33

Your port isn't open in your EC2 security group. Check your ec2 console to open the port with the security group tied to the server.

  • It's not a VPC, it's a "regular" EC2 instance. I cannot assign a security group when I select the instance and click actions. It's not a selectable option. Is there another way to edit/apply security rules? – user1104854 Sep 10 '15 at 20:28
  • Ec2 classic uses security groups as well. You can select security groups from the left side on the ec2 control panel. – David Eisen Sep 11 '15 at 21:01

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.