EC2 instance only accessible via SSH (22), HTTP/HTTPS blocked even though SG/NACL allow all

Based on your description, this appears to be an issue with your instance's firewall configuration rather than an AWS-level restriction. Since you can SSH into the instance but not access HTTP/HTTPS ports, even though your security groups and NACLs allow all traffic, the problem is likely at the OS level.

Here are the most likely causes and solutions:

1. Host-level firewall: Your EC2 instance's operating system firewall might be blocking incoming HTTP/HTTPS connections. Depending on your OS:

• For Ubuntu: Check if UFW is enabled with sudo ufw status and consider disabling it temporarily with sudo ufw disable
• For RHEL/CentOS/Amazon Linux: Check if firewalld is running with sudo systemctl status firewalld and try stopping it with sudo systemctl stop firewalld

2. iptables rules: Your iptables configuration might have rules that are blocking incoming connections. Check your current rules with sudo iptables -L. Look for REJECT rules that appear before your ACCEPT rules for HTTP/HTTPS ports. The order of rules matters in iptables - if a REJECT rule appears before an ACCEPT rule, the traffic will be rejected before reaching the ACCEPT rule.

3. Web server configuration: Nginx might be configured to only listen on localhost or specific IPs rather than all interfaces. Check your Nginx configuration to ensure it's listening on 0.0.0.0:80 (all interfaces).

4. Routing issue: The fact that you can't curl your public IP from inside the instance with "No route to host" error suggests a routing issue. This is expected behavior as AWS doesn't support hairpin NAT (accessing your public IP from inside the instance).

Since you mentioned that this was working before and suddenly stopped working, it's likely that a system update or configuration change modified your firewall settings. I would recommend checking your system logs to see if there were any recent changes or updates that might have affected your firewall configuration.

If none of these solutions work, you might want to try creating an AMI of your current instance and launching a new instance from it to see if the issue persists, which would help determine if it's an instance-specific problem or something broader.
Sources
Unable to Connect Http ports Even after allowing in Security group. | AWS re:Post
Can't connect to EC2 instance on any port other than SSH | AWS re:Post
EC2 instance with public IP can't access internet (HTTPS 443 timeout) | AWS re:Post