Symptoms & Diagnosis
When an Amazon EC2 instance becomes unreachable via its public IP, the impact on your application or development workflow is immediate. Usually, the AWS Management Console shows the instance state as “Running,” but your attempts to connect via SSH, RDP, or HTTP result in a “Connection Timed Out” error.
The first step in diagnosis is checking the Status Checks tab in the EC2 console. If “System Status Checks” or “Instance Status Checks” are failing, the issue is likely hardware-related. However, if both checks pass and you still cannot reach the IP, the problem is almost certainly a networking or configuration error.
Common diagnostic tools include using ping to check basic connectivity or telnet to test specific ports. If these fail, you must investigate the VPC infrastructure and security layers.
Troubleshooting Guide
Follow these steps in order to identify and fix the connectivity gap between your local machine and the EC2 instance.
1. Validate Security Group Rules
Security Groups act as a virtual firewall. If the inbound rules do not explicitly allow traffic from your specific IP address on the required port, the connection will be dropped.
| Protocol | Port Range | Source | Purpose |
|---|---|---|---|
| TCP | 22 | Your-IP/32 | SSH Access (Linux) |
| TCP | 3389 | Your-IP/32 | RDP Access (Windows) |
| TCP | 80 / 443 | 0.0.0.0/0 | Web Traffic |
2. Verify Internet Gateway (IGW) and Route Tables
For an instance to be reachable via a public IP, it must reside in a “Public Subnet.” This requires two things: an Internet Gateway attached to the VPC and a route in the subnet’s Route Table pointing 0.0.0.0/0 to that IGW.
Check the “Routes” tab for your subnet. If there is no entry for 0.0.0.0/0 targeting an igw-xxxxxxxx, the instance remains isolated from the public internet despite having a public IP assigned.
3. Check Network ACLs (NACLs)
Unlike Security Groups, Network ACLs are stateless. This means you must allow both Inbound AND Outbound traffic. Ensure that the Subnet’s NACL has an “Allow” rule for your port and an “Allow” rule for Ephemeral Ports (1024-65535) for the return traffic.
4. Inspect OS-Level Firewalls
Sometimes the AWS infrastructure is configured correctly, but the internal operating system firewall (like ufw, iptables, or Windows Firewall) is blocking the connection. You can check the status of these services if you have access via the EC2 Instance Connect or a Serial Console.
# Check UFW status on Ubuntu/Debian
sudo ufw status
# Check iptables rules on RHEL/CentOS
sudo iptables -L -nPrevention
To avoid future connectivity issues, implement the following best practices for your AWS environment.
Use Elastic IPs: Standard public IPs change when an instance is stopped and started. Assigning an Elastic IP ensures your entry point remains constant even after maintenance.
Enable VPC Flow Logs: These logs capture information about the IP traffic going to and from network interfaces in your VPC. They are invaluable for debugging “REJECT” responses that indicate where a connection is being blocked.
Audit via AWS Config: Use AWS Config rules to automatically alert you if a Security Group is modified to allow unrestricted access or if a Route Table loses its Internet Gateway connection.
Infrastructure as Code (IaC): Define your VPC and Security Groups using Terraform or CloudFormation. This prevents “manual drift” where someone accidentally deletes a necessary rule in the console.