I have an Amazon EC2 Windows Server 2012 instance set up with IIS 8.5 and I'm trying to setup multiple sites, each with a unique port binding. The problem comes when trying to access these sites from outside the instance.


  • I have tried many different ports, including: 80, 81, 8080, 2468, 10000, 10001, 10002
  • I have configured physical path authentication/authorization for the sites/app pools
  • I have configured Windows Firewall to allow inbound access on the necessary ports
  • I have configured the EC2 security groups to allow inbound access on the necessary ports

The only ports I have found to work are 80 and 10000. (Likely irrelevant, but the FTP site is working correctly.)


  • sites are accessible via localhost on the instance
  • When I use an online port checker tool, the ports show as open
  • "netstat -an" shows the ports as LISTENING
  • browsers (Chrome, FF, IE) show connection timed out when attempting to browse to one of these sites
  • cannot telnet into any port except 80 (not even 10000 which works in browser)
  • disabling Windows firewall on any/all profiles doesn't help
  • allowing all inbound traffic in EC2 security group doesn't help

I don't think this should be a complicated problem, but I've spent a long time trying to figure it out and find answers online, and I haven't come across anything relevant. Most of the search results say to open the ports in one firewall or another, which I've done to my knowledge.

Am I missing something? Other troubleshooting ideas? Let me know if I can provide more information. Thanks.

  • Have you tried connecting from various networks? The data you provided points to your local network being the problem. – EEAA Feb 16 '16 at 17:16
  • Not for nothing but why not use Host Headers instead of multiple ports? – joeqwerty Feb 16 '16 at 21:28
  • Thanks for the responses. I ended up going with Host Headers. – Aaron Neufeld Feb 29 '16 at 17:21

I know my answer is quite late, but the only other item I can think of is that you EC2 instance is within a VPN subnet that has a Network ACL that's only allowing inbound on port 80. Where security groups can control instance-specific in/out rules, the Network ACLs site around this and operate in the same way, but at an entire subnet level.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.