AWS EC2 Apache – Apache Server Not Reachable on New Instance

amazon ec2apache-httpdawsdebian

I am not able to access my web server I recently set up on Ubuntu AWS EC2 instance:

client:~ user$ curl yyy.yyy.yyy.yyyy
curl: (7) Failed to connect to yyy.yyy.yyy.yyyy port 80: Operation timed out

Apache is up and running at the AWS instance:

ubuntu@server:~$ sudo service apache2 status
* apache2 is running

and the port 80 is opened

ubuntu@server:~$ sudo netstat -plunt | grep apache2
tcp6     0    0 :::80                 :::*                  LISTEN    2968/apache2

I am not that experienced in setting up web servers so far, but as I know Apache should be accessible right after it was installed. What might be wrong in my case?

Best Answer

The web server seems to be listening to the actual port and running, accordingly to your netstat.

You have got to open the firewall rule in the AWS console.

Have a look at this: Authorizing Inbound Traffic for Your Linux Instances

Change SSH from the quoted test to HTTP.

To enable network access to your instance, you must allow inbound traffic to your instance. To open a port for inbound traffic, add a rule to a security group that you associated with your instance when you launched it.

To add a rule to a security group for inbound SSH traffic using the console

In the navigation pane of the Amazon EC2 console, choose Instances. Select your instance and look at the Description tab; Security groups lists the security groups that are associated with the instance. Choose view rules to display a list of the rules that are in effect for the instance.

In the navigation pane, choose Security Groups. Select one of the security groups associated with your instance.

In the details pane, on the Inbound tab, choose Edit. In the dialog, choose Add Rule, and then select SSH from the Type list.

In the Source field, specify the public IP address of your computer, in CIDR notation. For example, if your IP address is 203.0.113.25, specify 203.0.113.25/32 to list this single IP address in CIDR notation. If your company allocates addresses from a range, specify the entire range, such as 203.0.113.0/24.

Choose Save.

Related Solutions

Ssh – iptables is preventing ssh to aws ec2 instance

You need to change this line

sudo iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT

sudo iptables -A INPUT -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT

Because your rule matches only established (syn-ack) and related connections, not new ones (syn)

So complete rule should look like:

sudo iptables -A INPUT -i lo -j ACCEPT
sudo iptables -A INPUT -p tcp --dport 22 -d 34.195.109.193 -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT
sudo iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
sudo iptables -A INPUT -j DROP

sudo iptables -A OUTPUT -p tcp -m state --state ESTABLISHED,RELATED -j ACCEPT
sudo iptables -A OUTPUT -p tcp -j DROP

The last output rule, will allow established connections to your host.

Why is NFS client using low-numbered ports

(The following answer is derived in large part from Jeff Schaller's comments to my original post.)

In order to prevent non-root users from mounting an NFS volume, an NFS server can require that an NFS client use a privileged port (1-1023). However, allowing only root users to mount an NFS volume offers little security these days as anyone who can put a machine on the network can be root on that machine.

Because of this old security practice, some NFS clients will default to using privileged ports when connecting to an NFS server.

This can cause port conflicts if your client needs to run a service on a privileged port. One way to get around this is to set the minimum and maximum privileged ports that the NFS client will use so that the NFS client will avoid ports used by other services. This port range can be set as kernel parameters; in CoreOS these parameters can be stored in the the files /sys/module/sunrpc/parameters/min_resvport and /sys/module/sunrpc/parameters/max_resvport.

You can avoid the whole privileged port issue altogether by adding an option when mounting the NFS volume telling the system to use non-provileged ports. In the case of Linux this is the noresvport option (see also the Linux nfs(5) man page).

This is the mount command we ended up using on our CoreOS server:

fs-faa33256.efs.us-west-2.amazonaws.com:/ /efs nfs4 rw,relatime,vers=4.1,\
rsize=1048576,wsize=1048576,namlen=255,hard,noresvport,proto=tcp,timeo=600,retrans=2,sec=sys,\
clientaddr=10.30.102.250,local_lock=none,addr=10.30.102.170 0 0

Best Answer

Related Solutions

Ssh – iptables is preventing ssh to aws ec2 instance

Why is NFS client using low-numbered ports

Related Question