Unable to connect to AWS EC2 instance via http and https

huangapple go评论63阅读模式
英文:

Unable to connect to AWS EC2 instance via http and https

问题

I've been fighting this one for a bit. This was meant to be a test so I know how to configure my ec2 for hosting my personal website. I created a test ec2 instance to set up a react web app. I am able to ssh into the instance via the AWS Console and via PuTTY (I am on a Windows machine).

Configuration

我已经为所有的IPv4出站流量和IPv4任何地方的入站流量(ssh、http、https)配置了我的VPC、子网、acl等。Ec2有一个弹性公共IP。因此,我不需要NAT网关(正确吗?)。

Main Issue

但是,当我尝试运行 sudo apt update 时,我收到了以下消息:

sudo apt update result

更新失败,出现了101错误代码。正如您下面所看到的,我觉得我的出站连接应该是开放的。

入站规则 - 子网

类型 协议 端口范围
HTTP TCP 80 0.0.0.0/0
SSH TCP 22 0.0.0.0/0
HTTPS TCP 443 0.0.0.0/0

出站规则 - 子网

类型 协议 端口范围
所有流量 TCP 所有 0.0.0.0/0

路由表

我的路由表也有两个路由:

目标 目标
0.0.0.0/0 IGW ID
CIDR 本地

ACL - 入站

规则编号 类型 协议 端口范围 允许/拒绝
1 HTTP TCP 80 0.0.0.0/0 允许
2 SSH TCP 22 0.0.0.0/0 允许
100 HTTPS TCP 443 0.0.0.0/0 允许
* 所有流量 所有 所有 0.0.0.0/0 拒绝

ACL - 出站

规则编号 类型 协议 端口范围 允许/拒绝
100 所有流量 所有 所有 0.0.0.0/0 允许
* 所有流量 所有 所有 0.0.0.0/0 拒绝

我还将弹性IP附加到实例上,因为我认为这将有助于入站流量的可达性。

我已经检查并通过 sudo ufw disable 禁用了Ubuntu防火墙。

ubuntu firewall

此外

我无法ping通任何http或https地址。它们返回不可达。

ping example

我对一个 sudo apt update 中的失败端点的IP运行了可达性测试,结果是可达的。

Reachability test

我现在对任何建议都持开放态度(当然是关于安全的哈哈)。但我对VPC是新手,所以可能是我漏掉了一些基本的东西。然而,我要说的是,我已经在互联网上搜索了好几天,似乎没有什么能解决我的问题。或者至少已经推动我到了现在的位置。

总体目标是拥有一个公共IP,您可以通过https访问它,并查看一个托管的React应用程序示例。我不需要关于React的帮助 - 在这方面我没问题。主要关心的是连接性方面。

英文:

I've been fighting this one for a bit. This was meant to be a test so I know how to configure my ec2 for hosting my personal website. I created a test ec2 instance to set up a react web app. I am able to ssh into the instance via the AWS Console and via PuTTY (I am on a Windows machine).

Configuration

I have configured my VPC, subnet, acl, etc. for all outbound traffic on any IPv4 and inbound (ssh, http, https) traffic anywhere IPv4. Ec2 has an Elastic public IP. Therefore I do not need a NAT Gateway (Correct?).

Main Issue

Yet still when I try to run sudo apt update I am welcomed with:

sudo apt update result

The update fails with a 101 error code. As you can see below I feel like my outbound connection should be open.

Inbound Rules - Subnet

Type Protocol Port Range Source
HTTP TCP 80 0.0.0.0/0
SSH TCP 22 0.0.0.0/0
HTTPS TCP 443 0.0.0.0/0

Outbound Rules - Subnet

Type Protocol Port Range Source
All Traffic TCP All 0.0.0.0/0

Routing Table

My routing table also has two routes:

Destination Target
0.0.0.0/0 IGW ID
CIDR Local

ACL - Inbound

Rule Number Type Protocol Port Range Source Allow/Deny
1 HTTP TCP 80 0.0.0.0/0 Allow
2 SSH TCP 22 0.0.0.0/0 Allow
100 HTTPS TCP 443 0.0.0.0/0 Allow
* All Traffic All All 0.0.0.0/0 Deny

ACL - Outbound

Rule Number Type Protocol Port Range Source Allow/Deny
100 All Traffic All All 0.0.0.0/0 Allow
* All Traffic All All 0.0.0.0/0 Deny

I have also attached an elastic IP to the instance as I figured that would help the reachability of inbound traffic.

I have checked and disabled the Ubuntu firewall via sudo ufw disable

ubuntu firewall

Additionally

I am unable to ping any http or https addresses. They come back as unreachable.

ping example

I ran a reachability test to the IP of one of the failed endpoints in sudo apt update and what do you know.. it is reachable.

Reachability test

I am open to anything at this point (with regard to safety obviously haha). But I am new to VPC's so it is possible that I am missing something fundamental. However, I will say I have been scrounging the internet for days and nothing seems to fit my issue. Or it has at least pushed me to where I am now.

The overall outcome is to have a public IP that you can access via https and view a host react app example. I am not looking for assistance with the react stuff - I am fine in that regard. Mostly concerned with the connectivity aspect.

答案1

得分: 1

当发送HTTP请求时,请求是从您自己计算机上的随机端口发出的(在本例中为Amazon EC2实例)。虽然请求发送到端口80或端口443,但请求实际来自与特定请求相关联的端口号。

远程计算机将向该端口号发送响应。

例如,如果您向google.com发出请求,它可能来自端口12345。然后,Google将响应发送回您的IP地址和端口12345

然而,您的NACL规则配置明确禁止此入站流量。因此,响应被阻止了。

解决方法: 您应该将NACL设置保持为"允许所有",无论是入站还是出站流量。很少需要在NACL中限制流量,相反,使用安全组来限制对资源的访问更为合适。

此外,我不建议使用PING来测试网络。它只会告诉您PING是否正常工作,不利于诊断其他问题。而且,安全组和NACL都需要允许ICMP协议才能正常工作(而您的不允许)。相反,集中精力使HTTP正常工作,因为那才是您实际需要的。

英文:

When an HTTP request is sent, the request comes from a random port on your own computer (in this case, the Amazon EC2 instance). While the request is sent TO port 80 or port 443, the request comes from a port number that is tied to the specific request being made.

The remote computer will send a response to that port number.

For example, if you make a request to google.com, it might come from port 12345. Google will then send the respond back to your IP address and port 12345.

However, your configuration of the NACL rules specifically disallows this incoming traffic. Thus, the responses are being blocked.

Resolution: You should leave NACL settings as "Allow All" for both inbound and outbound traffic. There is rarely a need to limit traffic in NACLS -- instead, use Security Groups to restrict access to resources.

Also, I do not recommend PING as a test of the network. All it does is tell you if PING is working and doesn't help for diagnosing other problems. Also, the security group and the NACL would both need to allow ICMP protocol for it to work (and yours don't). Instead, concentrate on getting HTTP to work, since that is what you actually want.

huangapple
  • 本文由 发表于 2023年6月5日 07:12:16
  • 转载请务必保留本文链接:https://go.coder-hub.com/76402766.html
匿名

发表评论

匿名网友

:?: :razz: :sad: :evil: :!: :smile: :oops: :grin: :eek: :shock: :???: :cool: :lol: :mad: :twisted: :roll: :wink: :idea: :arrow: :neutral: :cry: :mrgreen:

确定