0

I'm hosting a default site for apache2 server on AWS EC2 (Ubuntu) with Elastic IP.

Security group set to open all inbound (testing purposed).

I can access the server via SSH using public IP but I can't via HTTP.

I can browse the site from localhost (using lynx 127.0.0.1).

I can also browse the site from a different EC2 on the same subnet.

Here is my iptables:

-P INPUT ACCEPT
-P FORWARD ACCEPT
-P OUTPUT ACCEPT
-A INPUT -p tcp -m tcp --dport 80 -j ACCEPT

open ports:

tcp               LISTEN             0                  128                                   0.0.0.0:22                                 0.0.0.0:*                                  
tcp               LISTEN             0                  511                                         *:80                                       *:*                                  
tcp               LISTEN             0                  128                                      [::]:22                                    [::]:*                                  
tcp               LISTEN             0                  511                                         *:443                                      *:*

Firewalls are inactive.

I have also just tried installing nginx on that second VM I spinned on the same subnet and curiously I also can't access the web server o port 80.

So now I also created a new instance on a separate subnet and still can't reach it via HTTP. It is reachable via SSH though.

Not sure what am I missing.

Update 1:

That's extremely bizarre, I have also MySQL running on that machine which is also accessible. Seems that routing and security groups are all correct but for some reason HTTP and HTTPS traffic is being blocked by something.

Update 2:

I turned on Flow logs on VPC and all my request on port 80 rejected, 22 and 3306 get in without problem.

my.ip.goes.here. 10.1.1.68 64087 80 6 1 64 1694528397 1694528415 REJECT OK

Network ACL is set to allow all inbound and outbound:

100 All traffic All All 0.0.0.0/0   Allow
*       All traffic All All 0.0.0.0/0   Deny

Security Group allows all traffic in and out:

All Traffic 0.0.0.0/0

This is getting stranger and stranger.

Artur Kedzior
  • 161

2 Answers2

0

Try using tspdump to track packets - whether the packet arrives at the host or not. If the packet arrives, then obviously something on the server is blocking or discarding it. Completely reset all firewall rules, or better yet, turn it off completely (for testing). Well, first of all, check the web server settings, it’s possible that something is not configured correctly. Try inserting a simple static page and the combination of these measures - you will definitely figure out the problem.

3v-Hosting
  • 1
0

I found a solution.

I opened up nginx on port 81 which worked ok and so I thought it must be only blocking any web ports.

After a bit of research this was due to the fact that my EC2 was reported with "EC2 Abuse Report".

In between millions of emails there was one:

We have received abuse report(s) implicating resources on your AWS account. As a result, we have taken the following steps against the implicated resources, in order to mitigate the activity:

** Blocked inbound HTTP ports 80,8080 and 443 in the region**

Previously there was different EC2 instance in that region that had a certain software installed that got hacked and it was shutdown.

It would be great if that was somehow indicated on the EC2 instance in the console.

Artur Kedzior
  • 161