Cannot connect to TCP port with curl command

Question

Hi,

I must say I am new in cloud computing so, if there are missing relevant details let me know. 
I am running a FlaskAPI in my AWS ubuntu machine. The API is listening in port 5000. 
In the past I was able to send html requests with curl (e.g curl http://my_aws_ipV4:5000) and the API would respond without any issue. Suddenly, it stopped working. However, the curl commands get a response if I send them in the AWS with localhost ip. 
Ping the AWS machine from my personal laptop works, although as far as I know ping command does not use TCP but UDP.

Here are the things I've checked and tried to make it work:
* Check inbound rules of security group for TCP on port 5000 - it is not blocking any ip
* Tried another port - for instance, 8000. Still, the outcome was the same as before.
* Restart the AWS machine
* Stop the Flask API and start again

All this attempts ended up without success on solving this issue. 
If by any chance someone already has faced this issue and knows a solution I would be glad to get support.

KR,
Carlos Garcia

Carlos · Accepted Answer

I am not running on a Ubuntu machine as I said in the post but on a Amazon Linux 2023. 
Tanvir's answer solved my issue:
https://repost.aws/questions/QUD9AaDnbvRhK8EQ9tT2w-YA/cannot-connect-to-tcp-port-with-curl-command#COXoS9nXM0TzuA5-2c5ifong
 
Answer:
You don’t need to restart your EC2 instance for security group or network ACL changes to take effect—they apply immediately. However, since you're using Amazon Linux 2023, here’s how you can check the firewall and allow traffic on ports 5000 and 8000:

Check and Modify Firewall Rules (Amazon Linux 2023) Amazon Linux 2023 uses nftables instead of ufw or iptables. Run the following command to check if any firewall rules are blocking the traffic:
sudo nft list ruleset
If necessary, allow traffic on the required ports:

sudo firewall-cmd --permanent --add-port=5000/tcp
sudo firewall-cmd --permanent --add-port=8000/tcp
sudo firewall-cmd --reload

Check if the rules were applied:

sudo firewall-cmd --list-all

Verify Flask is Running and Listening on 0.0.0.0 After making these changes, confirm that your Flask application is correctly listening on all interfaces:
sudo ss -tulnp | grep 5000

You should see something like:

LISTEN 0 128 0.0.0.0:5000  0.0.0.0:* users:(("python",pid,fd))
If Flask is not listening on 0.0.0.0, restart your Flask app.

Retest Access Try accessing your Flask API externally:
curl http://:5000

If it still doesn’t work, try stopping firewalld temporarily to see if it's causing the issue:

sudo systemctl stop firewalld

If stopping firewalld fixes the issue, you’ll need to permanently configure it to allow Flask traffic instead

tanvir · Answer

# Troubleshooting Flask API Accessibility in AWS

If your Flask API is not accessible from outside your AWS instance, but it works locally (e.g., with `curl` on `localhost`), there are a few things you can check. Below are steps to troubleshoot and fix the issue:

## 1. Check Flask Binding
By default, Flask binds to `127.0.0.1`, which means it only accepts requests from localhost. To allow external access, you need to bind it to `0.0.0.0`.

In your Flask app, modify the `run` method:

```python
app.run(host='0.0.0.0', port=5000)
```
This will allow the app to accept connections from any IP address.

## 2. Check Security Group
Ensure that your **AWS EC2 security group** allows **inbound traffic** on `port 5000`.
* Go to your **EC2 console**.
* Select your instance.
* Check the **Inbound rules** of your **security group**.
* Ensure there is an **inbound rule** for `TCP on port 5000` from any `IP (0.0.0.0/0)`, or specify the **IP range** you need to allow.

## 3. Check Network ACLs
Verify that the **network ACLs** associated with **your subnet** are not blocking **inbound or outbound **traffic on `port 5000`. Ensure that both inbound and outbound rules allow traffic on `port 5000`.

## 4. Check EC2 Instance Firewall
If your **EC2 instance** is running a firewall like **ufw (Uncomplicated Firewall)**, ensure that it's configured to allow traffic on `port 5000`. Run the following command to allow traffic:

```bash
sudo ufw allow 5000/tcp
```
## 5. Check CloudWatch Logs
Review your **CloudWatch logs** to check for any errors related to **network connectivity** or your **Flask app**. This can provide insights into whether your app is running properly or if there are issues preventing access.

## 6. Test with Curl from Outside AWS
After making the above changes, test the Flask API from an external machine by running the following command:

```bash
curl http://:5000
```
If everything is set up correctly, you should get a response from your Flask API.

Sources:
- [Unable to connect to port](https://repost.aws/questions/QUXgoCKJ0wSeybOR_IC4Z0EA/unable-to-connect-to-port-despite-changing-setting-in-security-group-and-firewall)
- [Troubleshooting Flask API Accessibility in AWS](https://itsaws.com/fixing-flask-api-connection-issues-on-aws-ubuntu-port-not-responding)

re:Post Agent · Answer

Thank you for providing details about your issue, Carlos. It seems you're experiencing connectivity problems with your Flask API running on an AWS EC2 instance. Let's go through some potential causes and solutions:

1. Security Group Configuration:
   While you've mentioned checking the inbound rules, it's worth double-checking that the security group associated with your EC2 instance explicitly allows inbound traffic on port 5000 (or 8000) from your IP address or 0.0.0.0/0 for testing purposes.

2. Network ACLs:
   Ensure that the Network ACL for the subnet where your EC2 instance is located allows inbound and outbound traffic on the required ports.

3. Firewall on the EC2 Instance:
   The Ubuntu instance might have a firewall (like UFW) enabled. SSH into your instance and check if the firewall is blocking the port:
   - Run `sudo ufw status` to check the firewall status
   - If it's active, ensure the port is allowed: `sudo ufw allow 5000/tcp`

4. Application Binding:
   Ensure your Flask application is binding to all interfaces, not just localhost. In your Flask app, use:
   ```python
   app.run(host='0.0.0.0', port=5000)
   ```

5. Check if the Application is Running:
   SSH into your EC2 instance and verify that the Flask application is actually running and listening on the correct port:
   ```
   sudo netstat -tuln | grep 5000
   ```

6. Public IP Address:
   Confirm that you're using the correct public IP address. EC2 instances can get a new public IP when stopped and started (unless using an Elastic IP).

7. Instance Health:
   Check the EC2 instance's health status in the AWS Console to ensure there are no underlying issues with the instance itself.

8. VPC Configuration:
   Ensure your EC2 instance is in a public subnet with an Internet Gateway attached to the VPC.

If none of these solve the issue, you may want to enable verbose logging in your Flask application to see if there are any application-level errors preventing it from properly handling incoming requests.

Remember, for security reasons, it's generally recommended to use HTTPS and restrict access to specific IP ranges rather than opening your API to the entire internet (0.0.0.0/0) in a production environment.  
**Sources**  
[Unable to connect to port despite changing setting in security group and firewall | AWS re:Post](https://repost.aws/questions/QUXgoCKJ0wSeybOR_IC4Z0EA/unable-to-connect-to-port-despite-changing-setting-in-security-group-and-firewall)  
[EC2 Connection issue | AWS re:Post](https://repost.aws/questions/QUkS-pglmQTQSwqmIksb97qw/ec2-connection-issue)

Cannot connect to TCP port with curl command

Troubleshooting Flask API Accessibility in AWS

1. Check Flask Binding

2. Check Security Group

3. Check Network ACLs

4. Check EC2 Instance Firewall

5. Check CloudWatch Logs

6. Test with Curl from Outside AWS

Add your answer

Relevant content