Search code examples
linuxamazon-web-servicesnetwork-programmingamazon-ec2aws-security-group

AWS - Security Groups not opening ports

I created a Linux t3a.nano EC2 on AWS, I haven't done anything on the instance other than starting it and connect to it through SSH.

I would like to open 2 ports, port 80, and 3000, for that, I created a Security Group and added both ports to the inbound rules.

enter image description here

Based on AWS documentation that is all you need to do in other to open the ports, but if I connect to the instance and list the ports open none of the ports on my Security Group are listening, only 22, but that is open by default.

I am running this command to list the ports: sudo netstat -antp | fgrep LISTEN

enter image description here

Other Steps I tried:

  1. Check my ACL, will attach a picture of the configuration below, didn't change anything it looks to be fine.
  2. Checked that the instance is using the correct security group.
  3. Stoped and started the instance.
  4. Created an Elastic IP and associated it to the instance to have a permanent public IP address.

enter image description here enter image description here enter image description here

Any suggestions about which steps could I am missing?

Solution

  • You are checking the ports from inside the instance. Security Groups (SGs) work outside of your instance.

    You can imagine them as a bubble around your instance. Subsequently, the instance is not aware of their existence. This can be visualized like on the below image, where the SG is a barrier outside of the instance. Only if SG allow traffic in, then your instance can further limit it by using regular software level firewalls.

    enter image description here

    To open/block ports on the instance itself you have to use a regular a firewall such as ufw. By default all ports on the instance will be opened, at least when using Amazon Linux 2 or Ubuntu.

    Therefore, with your setup, inbound traffic for pots 22, 3000 and 80 will be allowed to the instance.