I can't for the life of me connect to my EC2 instance over the web. I know there are six million posts about this already, but they all seem to be resolved the same ways.. but won't work for me.

What I have tried

  • Enabling relevant inbound (and outbound) traffic in security groups
  • Accepting all TCP traffic on port 80 via iptables
  • Updating /etc/apache2/ports.conf listen line to "Listen"
  • Restarting apache / EC2 instance between each and every step
  • Checking the 000 virtual host conf file - it's listening on port 80

What I can do

  • wget localhost - returns the apache2 landing page (so the web server definitely works
  • Ping the instance after setting up ICMP equivalent settings in Security groups - so I'm almost positive Security Groups ain't the problem

Is there anything else I can try?

In response to comments..

  • traceroute doesn't respond, but "sudo traceroute -T hostname" returns the correct FQDN and IP address
  • I haven't modified my network ACL (at least knowlingly), and AFAIK it defaults to allow all inbound/outbound traffic
  • My security group inbound rules are as follows:
HTTP TCP 80 ::/0
  • And I have no security group outbound rules
  • I haven't set up anything related to VPC, so everything should be default!
  • What are the results of traceroute host and tcptraceroute host 80 ? – Andrew Schulman Jan 24 '18 at 18:06
  • Checked Network ACLs? Is it in a public subnet connected to an internet gateway? There are probably quite a few ways this could happen, usually easy to figure out with access, but you haven't given any information about your setup so help here will be limited. – Tim Jan 24 '18 at 18:17
  • You mention "relevant outbound traffic in security group" What have you changed? For Outbound, you should allow all traffic unless you have a specific reason to change this. – John Hanley Jan 24 '18 at 18:17
  • I have updated the post with all info requested – Cathal Jan 24 '18 at 20:16
  • Add ICMP to your security group to allow ping / traceroute. Would be interesting to see how far it gets. I can ping / traceroute my AWS server, given I have ICMP open to my IP. If you share your IP / domain someone might be able to see a problem. – Tim Jan 24 '18 at 20:45

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.