I'm new to setting up applications and currently facing issues connecting to my IP address.
Recently, I launched my first AWS instance and it was working fine before I attached it to an Elastic IP (trying to attach to my GoDaddy domain). The instance state is "running" and everything looks healthy, but when I go to the Public IP/Elastic IP, I get an error message saying: "This site can’t be reached. XX.XXX.XX.XXX refused to connect". I'm using a Mac and my web server is listening on port 80.
Things I have checked:
internet connection is working
not using any firewall/anitvirus
emptied all cache/cookies
not using a proxy server
My Security Group
– inbound ports 80, 8080, 22 and 3389;
– outbound ports 8080, All traffic.
My VPC
– subnet ID is verified and "available"
– route Tables 172.31.0.0/16 & 0.0.0.0/0 are "active", not propagated
Can someone help and please point out what I'm doing wrong?
Attaching an Elastic IP Address to an Amazon EC2 instance does not change anything on the instance itself. It is purely an assignment of a Public IP Address within the Amazon VPC.
Amazon EC2 instances do not normally know their own public IP address. Instead, traffic sent to the Public IP Address is routed through the Internet Gateway and then to the private IP address of the instance. As long as you did not somehow configure the old public IP address within the instance, the assignment of the Elastic IP Address should not be a problem.
You can remove the Elastic IP Address and try connecting again -- the instance will receive an auto-assigned IP address again (which might change whenever you start/stop the instance).
Some things you could try are:
Connect to another instance in the same subnet, with the same Security Group. If this works, then you know that the problem is with the instance itself, rather than the network.
Try connecting to the non-responsive instance from another instance in the same subnet using the private IP address of the non-responsive instance. This will eliminate potential networking problems.
The standard things to always check when attempting to connect from the Internet to an EC2 instance are:
Internet Gateway attached to the VPC
You are referencing the instance via a Public IP Address
Instance was launched in a public subnet, which means that the subnet is associated to a Route Table that routes to the Internet Gateways
Security Group is permitting the inbound traffic from your IP Address and port (outbound traffic configuration is irrelevant because Security Groups are stateful)
Network ACL is not blocking the traffic (by default it permits all inbound and outbound traffic)
The instance is listening on the port (eg Linux SSH on port 22, Windows RDP on port 3389)
There are no host-based firewalls on the instance blocking traffic (eg Windows Firewall)
I always reboot my Linux servers on AWS after associating an elastic IP. Normally I wouldn't blindly suggest rebooting a Linux server, but I have found it helpful in cases like this. There are several things you should think about before rebooting. Making sure you don't have important files exclusively on volatile storage would be one example.
Re "...when I go to the Public IP/Elastic IP..." How are you going to the address? Sounds like you're trying to connect with a web browser.
Have you tried connecting from your Mac over some other protocol, like ssh? That would be another way to confirm that your elastic IP is in effect
Have you tried to connect to the web server more directly? Like using wget from the server's shell? You would use the private IP address or localhost, so that doesn't help diagnose the elastic IP address.
Related
I'm trying to connect my friend's MySQL database remotely but I'm getting connection timeout error. I tried to ssh. But same result.
Then I check that instance. It has public IP. Also allowed 3306 and 22 ports on the security group. Allowed 100th rule for all sources in subnet NACL.
What I'm missing? Is there any other way to block those traffic? Can anyone help me? I'm a still beginner
When an SSH connection times-out, it is normally an indication that network traffic is not getting to the Amazon EC2 instance.
Things to check:
The instance is running Linux
The instance is launched in a public subnet, which is defined as having a Route Table entry to points to an Internet Gateway
The instance has a public IP address, which you are using for the connection
The Network Access Control Lists (NACLs) are set to their default "Allow All" values
A Security Group associated with the instance that permits inbound access on port 22 (SSH) either from your IP address, or from the Internet (0.0.0.0/0)
Your corporate network permits an outbound SSH connection (try alternate networks, eg home vs work vs tethered to your phone)
See also: Troubleshooting connecting to your instance - Amazon Elastic Compute Cloud
Based on your descriptions, I would suggest checking whether the instance was launched in a public subnet.
I found the reason. That instance was deployed in a private subnet and didn't have inbound access.
Solution:-
I deployed a bastion host in a public subnet and used SSH agent forwarding to access the instance through the bastion host.
When I configure the security group with ssh protocol, port range 22 and I select MyIP, which is using my IP as I checked, the Ec2 Instance Connect does not work.
Anyone else has experienced this?
What is the work around? Having a static Ip address?
This is expected behaviour.
When doing a "normal" SSH connection from your own computer to an Amazon EC2 instance, the connection goes directly from your computer to the EC2 instance. Thus, the Security Group needs to permit the Inbound connection from the public IP address associated with your computer.
However, when using EC2 Instance Connect, an HTTPS connection is established between your computer and the EC2 Instance Connect Service inside AWS. That Service then establishes an SSH connection to the EC2 instance. Thus, the connection comes from the Service, rather than your own computer.
Therefore, the Security Group should permit inbound connections from the IP address range of the EC2 Instance Connect Service.
You can obtain these addresses from:
AWS IP address ranges - AWS General Reference
Search for EC2_INSTANCE_CONNECT
Select the range for your applicable region
I am always facing the below problem......
If I create a new RHEL (or any Linux) EC2 Instance without any modification of default VPC Setting or Network ACL or Route Table (RT is open for outbound 0.0.0.0/0 and connected to default IGW):
SSH will only work from my machine if I select 0.0.0.0/0.
In security Group In bound rule is I add My IP. SSH does not work.
Note:
The Public IP is current. 103.75.162.205
AWS provided CIDR in My IP [103.75.162.202/32] contains my Public IP.
So technically My IP should work, but it is not working or I never made it to work. What I am missing?
I recommend:
Open 0.0.0.0/0
Connect via SSH
Disconnect
Connect again: The instance will show the IP address from which you most recently connected
Use this displayed IP address in the Security Group
Sometimes corporate networks route HTTP traffic differently than SSH traffic due to proxies. The above steps will help you discover the address being used for SSH traffic.
My Public IP is: 103.75.162.202
I cannot use My IP option in Security Group, it always gives /32 and
I cannot change it to /24 or others... Need to use Custom IP
103.75.162.202/24. Tried with 103.75.162.202/31 it does not work...
Next I realized in a CIDR initial IP is used by AWS, hence, I changed
my CIDR to 103.75.162.198/24 and now it is working, both SSH and
Apache HTTPD
Well, I am almost giving up on aws it is really hard to do simple things here. My problem is I am following this link to setup cpanel for commercial use,
https://blog.cpanel.com/part-2-how-i-built-a-cpanel-hosting-environment-on-amazon-aws/
I set up my VPC, Subnet, Internet Gateways, Elastic IPs and Route Tables and still can not connect to my ec2. it is frustrating that I am wasting time over an ssh problem which can be solved in a matter of seconds in OVH and here AWS ruining my day any ideas?
I set up my VPC, Subnet, Internet Gateways, Elastic IPs and Route Tables
I really expect to connect to my ec2 with ease and be able to add more ec2/s to the service
To be able to SSH into an Amazon EC2 instance, you'll need the following:
An Amazon VPC (the default one is fine, or create your own)
An Internet Gateway attached to the VPC (to connect it to the Internet)
A public subnet, which is defined as a subnet that has a route table where the route table sends traffic destined for 0.0.0.0/0 to the Internet Gateway
An Amazon EC2 instance in the public subnet, presumably a Linux instance since you want to SSH to it
When launching the instance, nominate a Keypair. If you launch from an Amazon-provided AMI (eg Amazon Linux 2), the keypair will be copied to /users/ec2-user/.ssh/authorized_keys at startup.
The instance should either be launched with Auto-assign Public IP to receive a random public IP address, or associate the instance with an Elastic IP address to associate a static IP address
A security group attached to the EC2 instance permitting inbound SSH access (port 22) either from 0.0.0.0/0 or your own IP address
Don't play with the Network Access Control List (NACL) settings - they default to allowing all traffic in/out
To connect to the instance:
ssh -i YOUR-KEYPAIR.pem ec2-user#IP-ADDRESS
If the connection is immediately rejected, it suggests a problem with the keypair.
If the connection takes some time before failing, it suggests a network-related problem because it is unable to contact the instance. Some corporate networks block outbound SSH access, so try again from a different network (home vs office, or even tethered via your phone) to try and identify the issue.
I have set up a EC2 micro instance and installed Consul, but I can't seem to connect via Curl. I can connect to the instance from itself with curl http://localhost:8500/v1/agent/self for a test. However when I try to use the AWS public ipv4 from my local machine like so http://34.230.X.X:8500/v1/agent/self I get a connection refused. On the security group I have configured inbound port 8500 open to everyone. Everything seems to be in place and correctly configured is there something I'm missing?
The AWS VPC documentation has some steps for allowing EC2 instances to be reachable from the internet:
Attach an Internet gateway to your VPC.
Ensure that your subnet's route table points to the Internet gateway.
Ensure that instances in your subnet have a globally unique IP address (public IPv4 address, Elastic IP address, or IPv6 address).
Ensure that your network access control and security group rules allow the relevant traffic to flow to and from your instance.
It sounds like you have the public IPv4 address and have verified that the security groups are good; now just make sure you don't have any network ACLs set (or set appropriately if you have them), the internet gateway, and the route table.
It sounds like you need to set consul's client address to that of the public facing IP. You can do this with the -client option.
consul agent -server -bootstrap -bind="<Your private IP>" -client="<Your public IP>" -data-dir="<Your data dir>"
Disclaimer: This would allow anyone on the internet access to this consul agent's API. So take appropriate actions to secure this thing.