Can't connect to EC2 instance on any port other than SSH

Question

- My instance has an EIP allocated as its Public IP.
- I have Route 53 aliasing a hostname to my EIP.
- My instance as a Security Group that allows inbound SSH (tcp 22) and OpenVPN (upd 1194) traffic.
- My ACLs allow all traffic on all ports from all sources (0.0.0.0/0).
- I can connect to my instance over port 22 using my public hostname, which resolves to my EIP.

My iptables output:
```
$ sudo iptables -L
Chain INPUT (policy ACCEPT)
target     prot opt source               destination         
ACCEPT     all  --  anywhere             anywhere             state RELATED,ESTABLISHED
ACCEPT     icmp --  anywhere             anywhere            
ACCEPT     all  --  anywhere             anywhere            
ACCEPT     tcp  --  anywhere             anywhere             state NEW tcp dpt:ssh
REJECT     all  --  anywhere             anywhere             reject-with icmp-host-prohibited
ACCEPT     udp  --  anywhere             anywhere             udp dpt:openvpn

Chain FORWARD (policy ACCEPT)
target     prot opt source               destination         
REJECT     all  --  anywhere             anywhere             reject-with icmp-host-prohibited

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination         
ACCEPT     udp  --  anywhere             anywhere             udp spt:openvpn
```

As a network test, I tried using netcat to test the port:
```
$ nc -v -l 0.0.0.0 1194
```

On my personal computer:
```
$ nc -v  1194
nc: connect to  () port 1194 (tcp) failed: No route to host
```

However, when I try to connect to port 22:
```
$ nc -v  22
Connection to  () 22 port [tcp/ssh] succeeded!
SSH-2.0-OpenSSH_8.7
```

Clearly, I can route to the host since I'm running commands on it over SSH, but I can't tell where in the entire process I'm failing for other ports.

re:Post Agent · Accepted Answer

Based on your description, there are several potential issues preventing connections to ports other than SSH (port 22) on your EC2 instance. Let me analyze the problem:

1. **iptables Configuration Issue**: Looking at your iptables output, I can see a critical issue. The REJECT rule appears before your OpenVPN rule in the INPUT chain:
```
REJECT     all  --  anywhere             anywhere             reject-with icmp-host-prohibited
ACCEPT     udp  --  anywhere             anywhere             udp dpt:openvpn
```

This means all traffic is being rejected before the OpenVPN rule can be evaluated. Rules in iptables are processed in order, so your OpenVPN rule is never reached.

2. **Protocol Mismatch**: Your OpenVPN is configured for UDP port 1194, but your netcat test is using TCP by default. When you run `nc -v -l 0.0.0.0 1194`, you're listening on TCP port 1194, not UDP. For UDP testing, you need to use the `-u` flag with netcat.

3. **Network ACLs vs. Security Groups**: While you mentioned your Network ACLs allow all traffic, remember that Network ACLs are stateless, unlike security groups which are stateful. For Network ACLs, you need to ensure both inbound and outbound rules are properly configured, especially for the ephemeral port range (typically 1024-65535) which is needed for return traffic.

To fix these issues:

1. Reorder your iptables rules to place the ACCEPT rule for OpenVPN before the REJECT rule:
```
sudo iptables -D INPUT -j REJECT --reject-with icmp-host-prohibited
sudo iptables -A INPUT -p udp --dport 1194 -j ACCEPT
sudo iptables -A INPUT -j REJECT --reject-with icmp-host-prohibited
```

2. For testing UDP ports with netcat, use:
```
# On server
nc -u -v -l 0.0.0.0 1194

# On client
nc -u -v  1194
```

3. Double-check your security group to ensure it explicitly allows UDP traffic on port 1194, not just TCP.

If you're still experiencing issues after these changes, you might want to temporarily disable the host firewall completely for testing purposes (remember to re-enable it afterward):
```
sudo systemctl stop firewalld  # For RHEL/CentOS/Fedora
# or
sudo ufw disable  # For Ubuntu/Debian
```  
**Sources**  
[The connection has timed out. No access to ec2 | AWS re:Post](https://repost.aws/questions/QU_rHHRT_9QkKe4FCTcqJlnA/the-connection-has-timed-out-no-access-to-ec2)  
[Unable to access to EC2 via SSH or Instance Connect - Sorted! | AWS re:Post](https://repost.aws/questions/QUP54iOVwQRpOC5OC9sjozBA/unable-to-access-to-ec2-via-ssh-or-instance-connect-sorted)  
[SSH not working on fresh account, | AWS re:Post](https://repost.aws/questions/QUGaoBZgaHRequBRRIzrNikw/ssh-not-working-on-fresh-account)

Can't connect to EC2 instance on any port other than SSH

Add your answer

Relevant content