EC2 VPC Instance - Ports are filtered

Question

I've configured my server with a default security group, which has the following Inbound rules:

| Type | Protocol | Port Range | Source |
| All TCP | TCP | 0-65535 | 0.0.0.0/0 |
| All UDP | UDP | 0-65535 | 0.0.0.0/0|

With these rules, netstat shows the following output:

netstat -atn
Active Internet connections (servers and established)
Proto Recv-Q Send-Q Local Address           Foreign Address         State      
tcp        0      0 0.0.0.0:22              0.0.0.0:*               LISTEN     
tcp        0      0 0.0.0.0:5432            0.0.0.0:*               LISTEN     
tcp        0      0 0.0.0.0:1113            0.0.0.0:*               LISTEN     
tcp        0      0 10.0.1.31:2113          0.0.0.0:*               LISTEN     
tcp        0      0 127.0.0.1:2113          0.0.0.0:*               LISTEN     
tcp        0      0 0.0.0.0:11300           0.0.0.0:*               LISTEN     
tcp        0      0 0.0.0.0:11211           0.0.0.0:*               LISTEN     
tcp        0      0 0.0.0.0:6379            0.0.0.0:*               LISTEN     
tcp        0      0 0.0.0.0:80              0.0.0.0:*               LISTEN     
tcp6       0      0 :::22                   :::*                    LISTEN     
tcp6       0      0 :::5432                 :::*                    LISTEN     
tcp6       0      0 :::3306                 :::*                    LISTEN     
tcp6       0      0 :::6379                 :::*                    LISTEN  

So, in theory, I should be able to connect to port 1113 with TCP from any IP Address. But this is not working, the IP address is showing as filtered, as you can see in the following output:

The only ports that seem to be OK (open and not filtered) are 22 & 80. Here's the output I get when testing them with nmap:

PORT     STATE    SERVICE
22/tcp   open     ssh
80/tcp   open     http
1113/tcp filtered ltp-deepspace
2113/tcp filtered unknown
3306/tcp filtered mysql
6379/tcp filtered unknown

I even tried adding a custom inbound rule just for my IP and Port 1113, but the result is the same.

I suspect that some firewall is blocking traffic on those PORTS in my instance, but I'm not sure how to check that.

One thing to notice, is that this instance is in a Amazon VPC. However, the network ACL for this instance has the following inbound rule, that should allow income communications from all ports:

|Rule # | Type | Protocol | Port Range | Source | Allow / Deny |
| 100 | ALL Traffic | ALL | ALL | 0.0.0.0/0 |ALLOW |

Any ideas on what could be the issue here?

Thanks a lot for your help!

Answer 1

[I know this is an old post, but I was bitten by the very same thing just today and came across this very question. Expanded to add steps for Windows AMI]

Summary

When you fire up a new EC2 instance from a new AMI there seem to be conditions where the local firewall is set to filter everything except SSH.

Now that might be the default on the newer AMIs, or something at work such as fail2ban or such like. If you are using a Windows AMI, this could be the Windows firewall.

The symptoms are as you describe - you have a public-facing IP address (either directly attached or via Elastic IP), you have permissive Security Groups, and all is otherwise well. An nmap from another working server (NB be careful, AWS don't like people running nmap from EC2 instances even onto your own servers) will show port 22 open but everything else filtered.

Linux

TLDR; The quick fix is probably easy in order to flush the rules:

iptables -F

Ideally, run this first to list what the offending rule is:

iptables -L

But you should have a good look at why it was being set up that way. It's possible something like firewalld is running which is going to monkey with the rules and you have the choice of configuring or disabling it. These will tell you if it's running:

firewall-cmd --status
firewall-cmd --get-services

There are other firewall services, of course.

Once you think you have it right make sure you reboot the server to ensure everything comes up right rather than reverting to a catatonic state (services speaking).

Windows

If you are using a Windows AMI, you will need to adjust the firewalls.

1. Go to Control Panel > System and Security > Windows Defender Firewall
2. From here, you could turn it off and rely solely on your AWS security (not recommended) or selectively enable certain apps / ports.