why is port 53 open on my elastic IP

Question

I have an EC2 instance that is associated with an elastic IP.  The security group for this instance allows inbound ports 80, 443 and 22 from the internet and is wide open to the AZ subnets.  It is wide open on outbound.  Running netstat on my instance shows that it is listening on port 53 but only on interface 127.0.0.53.  When I scan my elastic IP from the internet it shows that port 53 is open despite not being listed among my inbound rules.  How is this possible?  What is actually listening on port 53 of the elastic IP?

update: Now port 53 is no longer open but the following ports are open 21 (ftp), 554 (rtsp), 1723 and 8443.  These ports do not show up in netstat on my EC2 instance.  I tried telneting to port 21.  I sent a few ftp commands with no response but the connection stayed open and was not closed.  This is all very strange and disconcerting.

Shadi Odah · Answer

Security groups are stateful and track connections. The behavior you're seeing may be related to:
- Return traffic being allowed due to the stateful nature of security groups

**Recommended step**:
- Verify no additional security group rules were added

Michael Shapira · Answer

Port 53 on AWS is used by the Domain Name System (DNS) service.
Here's the link to the official AWS documentation for Amazon Route 53:

https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/Welcome.html

why is port 53 open on my elastic IP

Add your answer

Relevant content