4

I'm trying to enable port 8080 between a pair of servers running in different availability zones (but the same region) on AWS.

I created a security group, added port 8080 as the port, and added the ID of the security group as the source. I then added this security group to both of the servers.

I am unable to connect from one machine to the other on port 8080, if I change the source to allow all, then I am able to connect.

Have I missed a step? It doesn't matter which group ID I use as the source, I still can't access without leaving it wide open. Is there perhaps another port that needs to be opened to service HTTP requests? The connection isn't refused, it just times out.

Improve this question
7
  • Do you have anything listening on port 8080 on the servers? Try running netstat -tulnp | grep 8080 (is this a Linux box?) Also, if your trying to make an outbound connection from point A -> B on AWS, you need to make sure that 8080 is open for outbound connnections.
    – ryekayo
    Jun 14, 2017 at 18:12
  • @ryekayo, there is something listening - if I make the source "from anywhere" I can connect
    – Zack Newsham
    Jun 14, 2017 at 18:14
  • Ok so what about the source SG? Does that have 8080 open as well?
    – ryekayo
    Jun 14, 2017 at 18:16
  • Are the two servers inside the same VPC? Or are they in different VPCs?
    – Matt Houser
    Jun 14, 2017 at 18:24
  • @MattHouser the same VPC
    – Zack Newsham
    Jun 14, 2017 at 18:43

2 Answers 2

Reset to default
9

Assuming Server A is trying to ping Server B and Server B's security group grants inbound access from Server A's security group...

You need to make sure Server A is pinging Server B via Server B's Private DNS Address (or Private IP Address) instead of Server B's public (or elastic) address.

According to the documentation:

Incoming traffic is allowed based on the private IP addresses of the instances that are associated with the source security group (and not the public IP or Elastic IP addresses).

If you select an instance from the Instances page on the EC2 Dashboard you can see the instance's public and private addresses.

enter image description here

Improve this answer
0

This sounds like a problem with ephemeral ports. It working when you open all ports is the main reason I think this.

Short version: when a computer connects to a port on another computer, it chooses a random port as the "source" port. This port has to be unblocked on the destination computer to allow traffic to return to it.

Read up on the ephemeral port range on your operating system - it varies, but 49152 to 65535 is standard. Open 8080 and that port range. If it works, leave them open, it's generally safe. The main thing is to ensure privileged ports (below 1000) are protected.

It's probably not applicable in this case, but when you have connectivity problems you should generally check Network ACLs.

Improve this answer
4
  • 1
    The default egress on the Security groups, at least in the console, is to allow all ports, so unless he does have specific outbound rules on the sec group it should work, given that port 8080 is open on inbound. NACL are a different story.
    – strongjz
    Jun 14, 2017 at 20:54
  • @strongjz you're right about the default, but given the information we have I think this is a reasonable theory. I'm happy to be proven wrong, but it's worth considering. It's easy to verify, let's wait to see what happens if Zack tries it.
    – Tim
    Jun 14, 2017 at 21:05
  • @Tim unfortunately all the outbound ports are open, and this problem is still continuing
    – Zack Newsham
    Jun 15, 2017 at 1:30
  • Can you please screenshot the security group settings and include in your question. Obfuscate anything you don't want to share.
    – Tim
    Jun 15, 2017 at 2:34

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .