180

I've opened port 80 in the web console on my E2C instance's security group but I still can't access it via the public dns in the browser.

Any ideas?

2
  • 2
    @Ripped Off, where would this question be more suitably placed? Nov 17, 2019 at 17:23
  • 1
    Seems I can't add an answer. For me it was a docker issue who wasn't listening on 80 and 443. Just restarted and then started to listen on 80 and 443. Mar 7, 2022 at 17:29

4 Answers 4

372

This is actually really easy:

  • Go to the "Network & Security" -> Security Group settings in the left hand navigation
  • Find the Security Group that your instance is apart of
  • Click on Inbound Rules
  • Use the drop down and add HTTP (port 80)
  • Click Apply and enjoy
13
  • 17
    He did mention that he's opened the port in the security group already, but it should be as easy as this...
    – aaaidan
    Jul 20, 2012 at 2:21
  • 9
    Question was not answered, port 80 is open as the question states
    – Pete_ch
    May 2, 2013 at 2:01
  • 4
    this helped us big time, the apply button is a little bit hidden, you have to scroll down to find it. May 29, 2013 at 9:45
  • 4
    I have already done this too, and it still doesn't work. Aug 8, 2013 at 12:06
  • 6
    Also, check your firewall (as nsof stated). RHEL has iptables started by default. Windows has windows FW. Turn them off and see if that was the problem. If it was, then edit the firewall to allow 80/443 and restart
    – Andrew
    Feb 28, 2014 at 8:36
23

Some quick tips:

  1. Disable the inbuilt firewall on your Windows instances.
  2. Use the IP address rather than the DNS entry.
  3. Create a security group for tcp ports 1 to 65000 and for source 0.0.0.0/0. It's obviously not to be used for production purposes, but it will help avoid the Security Groups as a source of problems.
  4. Check that you can actually ping your server. This may also necessitate some Security Group modification.
5
  • 9
    Er - I'd strongly recommend NOT disabling the Windows Firewall on an EC2 instance, ever. However, Server 2008 automatically keeps Port 80 closed by default, so you will need to add (or activate) the Port 80 'allow' rule. Feb 15, 2011 at 18:54
  • 1
    I should have added that all steps above are really for debugging the issue, but then you should revert back to whatever is appropriate for your setup. Feb 15, 2011 at 21:33
  • 2
    I agree with Jonners, especially if it's a windows box: any internet accessible box is liable to be portscanned by blackhats and script kiddies, even if naked to the internet for only a short time. "Reverting back", then continuing to use the potentially compromised server is a no-no for production use. Instead, burn the instance in the fires of hell and start a new one.
    – aaaidan
    Jul 20, 2012 at 0:27
  • About the "disabling windows firewall", I had the same question, about if I should do that or not. Then, I found a clear response from amazon. "We recommend that you disable Windows Firewall and control access to your instance using security group rules." docs.aws.amazon.com/AWSEC2/latest/WindowsGuide/… Apr 21, 2016 at 18:20
  • i was trying to access a Flask web server from the public IP address of an EC2 instance using the port i had forwarded. when the Flask server was running it indicated that the port was open since nmap -v -p 80 127.0.0.1 output 80/tcp open upnp, and i had disabled the firewall with sudo ufw disable. i found the reason why it wasn't working was actually because i failed to read the Flask web server documentation that required it be run with flask run --host=0.0.0.0, where flag --host=0.0.0.0 makes it an "Externally Visible Server" flask.palletsprojects.com/en/2.2.x/quickstart Nov 19, 2022 at 12:21
16
  1. Check what security group you are using for your instance. See value of Security Groups column in row of your instance. It's important - I changed rules for default group, but my instance was under quickstart-1 group when I had similar issue.
  2. Go to Security Groups tab, go to Inbound tab, select HTTP in Create a new rule combo-box, leave 0.0.0.0/0 in source field and click Add Rule, then Apply rule changes.
2
  • For step one, i didn't see a Security Groups column, but under Actions->Networking->Change Security Groups, I am able to see which group the instance is under.
    – MikeiLL
    Oct 31, 2015 at 20:22
  • I had ignored Step 1. Thanks May 7, 2016 at 4:07
12

For those of you using Centos (and perhaps other linux distibutions), you need to make sure that its FW (iptables) allows for port 80 or any other port you want.

See here on how to completely disable it (for testing purposes only!). And here for specific rules

2
  • This was it for me. I forgot that it was running :D
    – Andrew
    Feb 28, 2014 at 8:35
  • 1
    -A INPUT -m state --state NEW -m tcp -p tcp --dport 80 -j ACCEPT is the rule you could add to /etc/sysconfig/iptables
    – Trefex
    Oct 19, 2014 at 18:54

Not the answer you're looking for? Browse other questions tagged or ask your own question.