This is the situation:

We have an EC2 server which runs Elasticsearch and an Elastic Beanstalk (EB) environment. They both are in the same VPC.

This is my goal:

Allow access to EC2 (9200 port) only from instances generated by EB.

What I did and what happened:

Inside EC2 security group I added a rule to allow access to port 9200 from Elastic Load Balancer's security group. Didn't work - timed out. When tried to specify EB instances IP address - works.

After that I tried a more stripped down version just to see where the problem is. Created an empty security group "elasticsearch-client". Then created a security group "elasticsearch-server" with a following rule

Custom TCP Rule   |   TCP   |   9200   |   sg-xxxxxxxx (elasticsearch-client)

Attached the server group to Elasticsearch EC2 instance and client group to a new EC2 instance I want to do the search from. I tried to connect from client to the server but connection times out. I can connect to the server if I allow connections from everywhere so I know the Elasticsearch server works at least. Also it's possible to connect from the new EC2 instance if I specify it's IP in the security group.

Is the way I'm using security groups wrong? Is there another way I should be solving this?

Any help is much appreciated.

  • I think you need to use port 9300. Port 9200 is for the http interface. – Henrik Pingel Jun 13 '16 at 16:57
  • @knowhy thanks, but as I mentioned in the post - when I target the rule towards specific IPs - it works fine so the ES server port can't be the problem. – krabats Jun 19 '16 at 16:43

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.