0

I have encountered strange problem when I was deploying our application to AWS (more precisely Elastic Beanstalk which is based on EC2). We are using certain VOIP provided whose address is vh1107.ipex.cz. Application works normally on localhost (even on different hosting) however on AWS it fails to connect to this address. I also cannot ping it when I log to the instance, however it can ping any other internet address I tried. So what is wrong here? Could this address be on some AWS blacklist?

EDIT

Sorry I've put my question wrongly. I know difference between HTTP and ICMP, the thing is however I can ping it from my own machine so it means that server listens to ICMP and problem is in the AWS. Same goes for any HTTP client, e.g. curl vh1107.ipex.cz/calls -v runs fine on my machine but request hangs on AWS. Our former hosting can reach the server as well.

  • I ran the curl you provided above on my AWS instance and two Ubuntu instances. None of the systems could curl that server, they all said "curl: (7) Failed to connect to vh1107.ipex.cz port 80: Connection timed out". – Tim Jun 7 '17 at 19:05
  • Ok, I guess I will fill the ticket for AWS support then. Thank you – Petr Mensik Jun 8 '17 at 5:18
  • I don't think it's an AWS problem. – Tim Jun 8 '17 at 5:47
  • Ah, I misread your comment, did you mean Ubuntu instances not hosted on AWS? – Petr Mensik Jun 8 '17 at 5:58
  • Yes, sorry that wasn't more clear. One was running in a data center that isn't AWS, one was a virtualbox Ubuntu server VM my work desktop. I just tried it on an Ubuntu desktop in Virtualbox at home, same result. I think the problem is the URL you're trying to call is invalid. – Tim Jun 8 '17 at 7:32
1

That server doesn't respond to ping requests. Ping uses ICMP which many servers block at the firewall.

A bit more background: ping runs over ICMP (read this article), which is different and separate from the TCP protocol that http/https run over.

There's generally very little to gain for a website to allow people to ping it, and every way you allow users to access your website or servers introduces risk. I don't allow ICMP into my servers, other than from one specified IP address. Because they're separate protocols it's easy to block ICMP at the firewall. This is why you can't ping some servers.

Updated

Based on our conversation in comments, I can verify that the server is rejecting some connections based on location. From the Czech Republic I can connect (though the URL is invalid), from New Zealand or the USA I can't connect.

I think you'll need a different provider, a VPN, or co-operation from the provider.

  • But then why HTTP client which tries to connect to this address from our application times out? – Petr Mensik May 31 '17 at 8:50
  • 2
    @PetrMensik HTTP and ping are entirely different beasts, one may work while the other fails. It's like trying to phone someone in order to figure out if their doorbell works. – Jenny D May 31 '17 at 9:10
  • @JennyD Best comment of the week. :) – EEAA May 31 '17 at 11:52
  • Very funny @JennyD :) I've also expanded my answer a little to provide more background. – Tim May 31 '17 at 18:50
  • @Tim upvoted your answer - my comment was aimed at the asker, not at you; it was already obvious that you knew the difference, but the asker doesn't... – Jenny D Jun 1 '17 at 5:29
0

Have you had a look at the security group that your Elastic Beanstalk application is using? you need to make sure that the security group allows the correct traffic Inbound. here a an extract from AWS Doumentation:

The security groups attached to your instances determine which traffic is allowed to reach the instances (ingress), and which traffic is allowed to leave the instances (egress). Elastic Beanstalk creates a security group that allows traffic from the load balancer on the standard ports for HTTP (80) and HTTPS (443). You can specify additional security groups that you have created to allow traffic on other ports or from other sources. For example, you can create a security group for SSH access that allows ingress on port 22 from a restricted IP address range or, for additional security, from a bastion host to which only you have access.

  • Yes, mu rule is that Inbound is allowed for ports 22 and 80, Outbound permits all traffic. So I guess this should be fine – Petr Mensik Jun 7 '17 at 12:34

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.