- Newest
- Most votes
- Most comments
To supplement the generated response, have you reviewed your Network Access Control List (NACL) for the subnet this instance resides in?
Network ACLs are stateless, so you need to specify both outbound and inbound traffic using a rule based logic. I would recommend reviewing and updating your Network ACL outbound rule to allow ephemeral ports (1024-65535). This may correct a possible scenario in which your request via ssh is going through, but the instance cannot reply. You can see an example of this in the AWS Documentation
For security purposes, I would also recommend you review your security groups, as they are currently open to the world (0.0.0.0/0). I know this is likely for troubleshooting, but at a minimum, restrict the ssh access to only your IP once this issue is resolved.
Based on your description, you've already checked several key areas that often cause SSH connection timeouts, but there are still a few things to investigate.
When you get a "Connection timed out" error, it typically indicates that network packets aren't reaching your instance or responses aren't making it back to your client. Since you've already verified that:
- Your security group allows inbound traffic on ports 22, 80, and 443
- Your subnet has a route to the Internet Gateway (0.0.0.0/0 → IGW)
- Your instance has a public IP address
- You've tried from different networks (including your phone's hotspot)
Here are additional areas to check:
-
Network ACLs: Check if your subnet's Network ACLs are blocking incoming SSH traffic. Unlike security groups, Network ACLs are stateless and require both inbound and outbound rules.
-
Instance Status: Verify that your instance is in the "running" state and has passed all status checks in the EC2 console. Failed status checks could indicate underlying issues.
-
OS-level Firewall: The instance might have an OS-level firewall (like iptables) blocking incoming connections.
-
Alternative Access Methods:
- Try using EC2 Instance Connect from the AWS Management Console, which bypasses potential local network issues
- If configured, use AWS Systems Manager Session Manager to start a secure shell without needing SSH access
- VPC Reachability: Use the VPC Reachability Analyzer to diagnose potential network configuration issues.
If you still can't connect, consider:
- Creating a temporary instance in the same subnet to test network connectivity
- Using the AWSSupport-ResetAccess runbook in AWS Systems Manager to regain access
- If you have EC2 Serial Console access configured, you might be able to troubleshoot through that interface
As a last resort, you might need to stop and restart the instance, which will change the public IP address if you're not using an Elastic IP.
Sources
Unable to SSH into AWS EC2 Instance – Connection Timed Out & Forgot Credentials | AWS re:Post
Troubleshoot issues connecting to your Amazon EC2 Linux instance - Amazon Elastic Compute Cloud
Can't connect to Linux instance even after the health status checks pass | AWS re:Post
Error establishing SSH connection to your instance. Access to EC2 has been lost | AWS re:Post
Thanks For the reply Dan. I have been implementing what you told me to do over the past few days and also reviewing the Doc's you sent me.
I currently have 2 rules associated with my inbound and 2 outbound rules in the NACL's. The default All traffic Deny rule and a all traffic Allow rule. This is on both the in and out with the Source and Destination being 0.0.0.0/0 for testing(Can upload a pic of settings if it makes it easier).
This allows me to EC2 Instant Connect and connect through my terminal in VS, but still not able to connect via http or https. Even if I add rules for http or https to the NACL.
When I check my security groups I notice I have 2 different ones that are associated with my VPC. A launch-wizard and a default. I tried adding rules to them both but still no able to connect via http or https.
I also checked my Route Table in my subnet and can confirm that I have my igw config to 0.0.0.0/0 and ::/0.