EC2 instance port is not accessible from the client
Hi!
I'm trying to set up VNC from my EC2 instance to my laptop. I've added a inbound rule for default security group for port 5901. I also checked VPC Network ACLs and they all look permissive here.
vncserver :1, but I can't access it from my laptop (tried multiple VNC clients). This is how my inbound rules are looking.
ncat -l 5901 on the server and telnet <public-ip> 5901 on the laptop. I don't receive any traffic on the server. So I assume the problem is not in vnc setup, but in instance security group? What else can I do to investigate the issue?
- Newest
- Most votes
- Most comments
The issue is most likely related to outbound NACL rules. You need to open the ephemeral ports for outbound NACLs. Note that, NACL are unidirectional, that is, the return traffic is not allowed by default and out have to allow it via outbound NACL rules. Also, The return port could be any of the ephemeral ports.
Outbound port range: 1024-65535, ALLOW, Protocol: TCP, Destination: 0.0.0.0/0
Refer: https://repost.aws/questions/QUTRF2zpJeQvCQDIP3hHxhnw#AN4hEjF_U2QGCCjOLW8USksA
Based on the information provided, it seems that you've taken several steps to configure access to your EC2 instance for VNC, but are still encountering issues. Here are some additional troubleshooting steps and considerations:
-
Security Group Configuration: While you've added an inbound rule for port 5901, ensure that the source IP in the security group rule matches your client's IP address. If you're using a dynamic IP, you might need to update this rule regularly or use a broader CIDR range.
-
Instance Network Settings: Verify that your EC2 instance is in a public subnet with an Internet Gateway attached, allowing for inbound traffic.
-
VNC Server Configuration: Ensure that the VNC server is configured to accept connections from external IP addresses, not just localhost.
-
Firewall on EC2: Check if there's a firewall running on the EC2 instance itself (like iptables for Linux) that might be blocking incoming connections.
-
VPC Route Tables: Confirm that the route table for your subnet has a route for 0.0.0.0/0 pointing to the Internet Gateway.
-
Try a Different Port: As a test, try configuring VNC to use a different port (e.g., 5902) and update your security group accordingly.
-
EC2 Instance Connect: If possible, use EC2 Instance Connect or SSH to access your instance and check if the VNC server is running and listening on the correct interface.
-
Check Instance Status: Ensure both status checks for your EC2 instance are passing. A failing status check could indicate underlying issues.
-
Network Connectivity: From your client machine, try using tools like traceroute to see if there are any network connectivity issues between your client and the EC2 instance.
If these steps don't resolve the issue, you may need to engage AWS support for more in-depth troubleshooting, as there could be complex networking issues at play.
Sources
Cannot access my EC2 instance via VNC | AWS re:Post
EC2 Instance Connect cannot connect to my instance ! | AWS re:Post
Jboss server port of ec2 instance is not accessible from another instance on same vpc | AWS re:Post
Relevant content
asked 2 years ago
asked 3 years ago
This worked, thank you!