Not able to Access rest service deployed in EC2 from another EC2 - amazon-ec2

I have a rest application running in EC2 instance(say win1). I have another EC2 instance(say win2) running in the same VPC as win1. I'm not able to access/call the rest URL exposed in win1 from win2. I have configured the security the group to allow http request in inbound.
Security group rule:
Inbound:
Protocol Port Range Source
HTTP (80) TCP 80 0.0.0.0/0
HTTPS (443) TCP 443 0.0.0.0/0
In outbound i have enabled all traffic. The rest API exposed by win1 is
http://<IP>:9090/ui
.

you exposed port 9090 by win1, but security group, you just allow inbound port : 80 and 443 only.
You need :
Inbound:
Protocol Port Range Source
HTTP (80) TCP 80 0.0.0.0/0
Custom TCP TCP 9090 0.0.0.0/0
HTTPS (443) TCP 443 0.0.0.0/0

Related

Hosting Redis on EC2 - ConnectionTimeoutError

I have an EC2 instance behind a load balancer. The security group attached to it allows for inbound connections (both ipv4 and ipv6 on port 6379). I am able to connect to my redis client:
redis-cli -h ec2-**-**-**-*.us-west-1.compute.amazonaws.com -p 6379
However, when I try to connect with nodeJS and express-session I get a ConnectionTimeoutError on EC2, but locally it works fine:
const redisClient = createClient() // uses default port localhost:6379
redisClient.connect().catch(console.error)
If there is a race condition here, like others mentioned, why does this race condition happen on EC2 and not locally? Is the default localhost incorrect since there is a load balancer in front of the instance?
Based on your comments, I'd say the problem is the load balancer. Redis communicates on a protocol based on TCP. An ALB is only for HTTP/HTTPS traffic, so it cannot handle this protocol. Use a Network Load Balancer instead, with a TCP listener. Also make sure your security group rule also allows TCP traffic for port 6379.
Redis client should be instantiated explicitly in a setup like this one (covers both ipv4 and ipv6 inbound traffic):
createClient({ socket: { host: '127.0.0.1', port: 6379 }, legacyMode: true })
As redis is self-hosted on EC2 with a load balancer in front of the instance, localhost may not be mapped to 127.0.0.1 as a loopback address. This means that the default createClient() without a host or port specified, might try to establish a connection to a different internal, loopback address.
(Make sure to all inbound traffic to tcp 6379, or the port you are using)

What env var to send requests to a HAProxy instance?

I have a HAProxy configured that works as expected when sending requests directly to the proxy host and port that the proxy is listening on. The proxy is running in TCP mode.
frontend tcp-in-mssql
bind :5650
mode tcp
use_backend mssql
backend mssql
mode tcp
server mssql01.mydomain.com mssql01.mydomain.com:5650 check
When I try to send requests to the proxy by using the SOCKS_PROXY or ALL_PROXY env vars, the proxy isn't used and the connection is made directly.
example:
SOCKS_PROXY=socks://localhost:5650 my_command --target=mssql01.mydomain.com:5650
ALL_PROXY=socks://localhost:5650 my_command --target=mssql01.mydomain.com:5650
The proxy is bypassed and a TCP connection is made directly to the target host. Though if do something like my_command --target=localhost:5650 the TCP connection goes through the proxy and is made successfully to the backend target server.
How can I route traffic to the proxy?
Socks is a specific protocol to be spoken by client and proxy (https://en.wikipedia.org/wiki/SOCKS). Socks allows the client to specify which server to connect to on which port. To do so, the client establishes a connection to the socks proxy, the socks proxy then establishes a connection to the server and forwards the traffic from client to server and vice versa.
Example:
client -> socks proxy (port: 1080) -> server1 (port: clients choice)
-> server2 (port: clients choice)
-> serverN (port: clients choice)
-> server (clients choice)
Your HAProxy configuration configures the haproxy to serve as a reverse proxy for tcp connections on port 5650. Tcp traffic received on port 5650 will then be forwarded to one of the destination servers configured in backend section.
Example:
client -> reverse proxy (port 5650) -> backend (server and port
as defined in haproxy config)
So you already have a working solution for proxying the connection to the mssql backend. Just configure the mssql client to connect to the hapoxy on port 5650.
If you need a socks proxy to suit your use case, you have to replace the haproxy with a dedicated, socks capable proxy solution

Can't access ec2 instance via fsockopen in PHP pointed at my ec2 public IP and designated port

Before anything else, I have read about 30+ StackOverflow answers and none of them seem to address my particular flavour of this problem. Below I list all the answers I have already tried before asking for more advice.
I am trying to access my ec2 instance via socket in PHP from a different machine via fsockopen, pointed at my ec2 public IP (I have an Elastic fixed IP address 54.68.166.28) and designated port.
Behaviour: I can access the instance and the ChatScript application running inside from within the instance, via the public IP directly on the browser. But if I run the exact same webpage with the exact same socket call on an external machine targeting my instance's IP address (double checked it is the correct one) I get a 500 Internal Server Error when connecting on port 1024 (for my custom TCP connection), another 500 on port 443 (HTTPS). On port 80 (HTTP) it hangs 20+ seconds then gives me status 200 success, except it does not connect properly to the application and responds with nothing.
Troubleshooting:
I have set up my security group rules to accept incoming TCP from anywhere:
HTTP (80) TCP 80 0.0.0.0/0
HTTP (80) TCP 80 ::/0
HTTPS (443) TCP 443 0.0.0.0/0
HTTPS (443) TCP 443 ::/0
Custom (1024) TCP 1024 0.0.0.0/0
Custom (1024) TCP 1024 ::/0
Outbound rules span port range 0 - 65535 with destination 0.0.0.0/0, so should work.
I ssh every time without problems into the instance on port 22. SCP also works fine.
Checked $sudo service httpd status: running, which is why my UI displays there fine.
Checked $sudo /sbin/iptables -L and all my policies are set to ACCEPT with no rules
Checked $ netstat --listen -p and the app I am targeting is listening on port 0.0.0.0.0:1024.
Checked Network Utility and ports 80 and 1024 are registered as open. Port 443 is not. Pinging did not work for any of them, with 100% packet loss.
Checked my instance is associated to the security group with all the permissions - it is. IP is clearly correct or I could neither ssh nor serve webpages... which I can.
I stopped and restarted the instance.
I replaced the instance.
I think this is due diligence before asking for help... now I need it!
I realised my configuration was correct: the problem was that the hosted domain I used for the GUI, like most hosted domains, does not open custom ports, so tcp did not work.

ElasticSearch - specifying an exact port (no port range)

I want to specify an exact port for ElasticSearch to use for HTTP traffic. How can I do so? In the config file, it says it listens to a port range by default. How can I restrict this port range to just 1 port?
Elasticsearch, by default, binds itself to the 0.0.0.0 address, and listens
on port [9200-9300] for HTTP traffic and on port [9300-9400] for node-to-node
communication. (the range means that if the port is busy, it will automatically
try the next port).
In config folder.. There is an file called "elasticsearch.Yml". In that
Parameters for port are commented.. Just remove hash before http.port and add port value to it..
http.port : 5000
You can do this for both tcp and http

How to capture only incoming TCP streams in WireShark?

How to capture only incoming TCP streams in WireShark?
(I would like to capture only HTTP connections to my web server, not any outgoing HTTP connections from applications.)
Based on my test,
1. You can use this capture filter for the WireShark that running on the server which you want monitor incoming packets:
dst host 10.58.123.456 and dst port 8080
And you can use following result filter to view traffic comes from certain client:
ip.src_host == 10.78.123.456
Use a filter like (ip dst host 192.168.0.1 and tcp dst port 80) or (ip src host 192.168.0.1 and tcp src port 80).

Resources