I am going through exercises in the book "Sinatra Up & Running" and am trying to send HTTP messages to Sinatra using Telnet.
This is what I am trying to do
[~]$ telnet 0.0.0.0 4567
However, I get the error:
Trying 0.0.0.0...
telnet: connect to address 0.0.0.0: Connection refused
telnet: Unable to connect to remote host
Sinatra is listening on localhost:4567 instead of 0.0.0.0:4567 and I think that is indicative of the problem.
I found some documentation at http://www.sinatrarb.com/configuration.html that talks about being able to specifically configure the development environment to listen on 0.0.0.0. I passed in:
ruby server.rb -o set :bind, '0.0.0.0'
And was able to adjust where Sinatra was listening to 0.0.0.0:4567 but telnet 0.0.0.0 4567 still gives the same error messages.
When you tell the server to listen on 0.0.0.0, that isn't actually a specific address, you're really telling it to bind to all available network interfaces. To connect to it, use either 127.0.0.1 or localhost, which are special addresses that always mean "this host":
telnet 127.0.0.1 4567
If you bind Sinatra to 0.0.0.0:4567 and it is listening they you will be able to externally hit your machine via the machine's ip.
E.g. machine-01 (192.168.122.100) is running Sinatra, which is bound to 0.0.0.0:4567 then from machine-02 (192.168.122.200) you'll be able to telent 192.168.122.100:4567 (provided there are no firewalls).
As the other post suggested, if you're trying to do it all on machine-01, then you want to bind Sinatra to localhost:4567 (127.0.0.1:4567), then you will be able to telenet localhost:4567
Related
I am building simple webpage.
I could run on my local host.
I made ec2 instance, I opened ports 22, 8000.
I could connect with ssh and run server for webpage,
but I get this error
this is my github address that contain the code.
enter link description herehttps://github.com/MoreNiceJay/django2
In your security group rules, open port 80
This is the standard port for http traffic
Other things to check: login to the host with ssh and use netstat |grep LISTEN to see if there is a process listening on port 80
I have an EC2 instance which is running with the following security groups:
HTTP - TCP - 80 - 0.0.0.0/0
Custom UDP Rule - UDP - 1194 - 0.0.0.0/0
SSH - TCP - 22 - 0.0.0.0/0
Custom TCP Rule - TCP - 943 - 0.0.0.0/0
HTTPS - TCP - 443 - 0.0.0.0/0
However, when I try to access http://{PUBLIC_IP} or https://{PUBLIC_IP} in the browser, I get a "{IP} refused to connect" error. I'm new to AWS. Am I missing something here? What should I do to debug?
One way to debug this particular class of problem is to use netcat in order to determine where the problem lies.
If you run netcat against port 80 on the public IP address of your instance and just get a hang (no output at all), then most likely your security group isn't allowing traffic through. Here is an example from an EC2 instance that is in a security group that doesn't allow port 80 traffic inbound:
% nc -v 55.35.300.45 80
<just hangs>
Whereas if the security group is changed to allow port 80, but the EC2 instance doesn't have any process listening on port 80, you'll get the following:
% nc -v 55.35.300.45 80
nc: connectx to 52.38.300.43 port 80 (tcp) failed: Connection refused
Given that your browser gave you a similar "connection refused", most likely the problem is that there is no web server running on your instance. You can verify this by ssh'ing into the instance and seeing if you can connect to port 80 there:
ssh ec2-user#55.35.300.45
% nc -v localhost 80
nc: connect to localhost port 80 (tcp) failed: Connection refused
If you get something like the above, you're definitely not running a webserver.
I'm not sure if it's too late to help but I was stuck with a similar issue with my test server
SG Inbound: ssh -> 22
HTTP -> 80
NACL: default allow/deny settings
but still couldn't ping to the server from my browser, then I realize there's nothing running on the server that can serve the request, and I started httpd server (webserver) and it worked.
sudo yum -y install httpd
sudo service httpd start
this way you can test the connectivity if you are playing with SGs and NACLs and of course it's not the only way, just an example if you're figuring your System N/W out.
Have you installed webserver(ngingx/apache) to serve your requests. If so please share your the config files. (So that it will help to troubleshoot)
I think the reason is probably that you did not set up a web server for your EC2 instance, because if you try to access http://{PUBLIC_IP} or https://{PUBLIC_IP}, you need to have a background server to serve the http request as #Niranj Rajasekaran said.
By the way, by simply pinging the {PUBLIC_IP}, you could see if your connection to your EC2 instance is normal or not.
In command prompt or terminal, type
ping {PUBLIC_IP}
In my case, the server was running but available on just 127.0.0.1 so it refused connections from external hosts. To see if this is your situation, you can run
netstat -an | grep <port number>
If it says 127.0.0.1:<port number> instead of 0.0.0.0:<port number>, you have this problem.
Usually there's a flag or an argument in your server code somewhere to set the host to 0.0.0.0:
app.run(host='0.0.0.0') # flask example
However, in my case, I had already set this so I thought that couldn't possibly be the issue, which is how I ended up on this thread, which asks more generally about the problem. Unfortunately, I was using docker, and had set 0.0.0.0 on the container but was mapping that explicitly to 127.0.0.1 on the host in the docker-compose port-mapping:
ports:
- "127.0.0.1:<port number>:<port number>"
Changing that line to remove the host IP specification fixed the problem upon re-deploy:
ports:
- "<port number>:<port number>"
I have a simple rails app set up on EC2 and I run it with Unicorn. I want to set it up now so that it runs on port 80. Using the -p flag with the unicorn_rails command did not work; I received an error saying permission denied:
[ec2-user#ip-10-164-110-7 current]$ unicorn_rails -p 80
F, [2013-08-02T04:41:41.441613 #3297] FATAL -- : error adding listener addr=0.0.0.0:80
/home/ec2-user/uc_social_server/shared/bundle/ruby/1.9.1/gems/unicorn-4.6.3/lib/unicorn/socket_helper.rb:147:in `initialize': Permission denied - bind(2) (Errno::EACCES)
from /home/ec2-user/uc_social_server/shared/bundle/ruby/1.9.1/gems/unicorn-4.6.3/lib/unicorn/socket_helper.rb:147:in `new'
from /home/ec2-user/uc_social_server/shared/bundle/ruby/1.9.1/gems/unicorn-4.6.3/lib/unicorn/socket_helper.rb:147:in `bind_listen'
Searching for solutions online, I keep finding posts about setting up Nginx + Unicorn. Then there are some mentions of using IpTables to redirect port 8080 traffic to port 80.
I am not sure which approach to take.
Do I need Nginx?
Is there a way ec2-user can be allowed to run the unicorn process on port 80?
Is the IpTables solution a good approach? I somehow don't think it is.
Here they apparently solved the problem you have with unicorn -p:
Unable to start unicorn on port 80 using capistrano
The other two solutions are also both going to work well.
With IPtables you can redirect the incoming traffic from port 80 to your unicorn socket listening on 8080 and back. That's happening on the TCP layer.
The nginx approach is a transparent proxy setup. All magic is happening on the HTTP layer which gives you the advantage of being able to manipulate requests and responses, set up caching etc. nginx is a lovely tool which probably beats unicorns possibilities by far (and won't really slow you down while)
This is a very basic Amazon EC2 question, but I'm stumped so here goes.
I want to launch an Amazon EC2 instance and allow access to HTTP on ports 80 and 8888
from anywhere. So far I can't even allow the instance to connect to on those ports using
its own IP address (but it will connect to localhost).
I configured the "default" security group for HTTP using the standard HTTP option on the management console (and also SSH).
I launched my instance in the default security group.
I connected to the instance on SSH port 22 twice and in one window launch an HTTP server
on port 80. In the other window I verify that I can connect to HTTP using the "localhost".
However when I try to access HTTP from the instance (or anywhere else) using either the public DNS or the Private IP address I het "connection refused".
What am I doing wrong, please?
Below is a console fragment showing the wget that succeeds and the two that fail run from the instance itself.
--2012-03-07 15:43:31-- http://localhost/
Resolving localhost... 127.0.0.1
Connecting to localhost|127.0.0.1|:80... connected.
HTTP request sent, awaiting response... 302 Moved Temporarily
Location: /__whiff_directory_listing__ [following]
--2012-03-07 15:43:31-- http://localhost/__whiff_directory_listing__
Connecting to localhost|127.0.0.1|:80... connected.
HTTP request sent, awaiting response... 200 OK
Length: unspecified [text/html]
Saving to: “__whiff_directory_listing__”
[ <=>
] 7,512 --.-K/s in 0.03s
2012-03-07 15:43:31 (263 KB/s) - “__whiff_directory_listing__” saved [7512]
[ec2-user#ip-10-195-205-30 tmp]$ wget http://ec2-50-17-2-174.compute-1.amazonaws.com/
--2012-03-07 15:44:17-- http://ec2-50-17-2-174.compute-1.amazonaws.com/
Resolving ec2-50-17-2-174.compute-1.amazonaws.com... 10.195.205.30
Connecting to ec2-50-17-2-174.compute-1.amazonaws.com|10.195.205.30|:80... failed:
Connection refused.
[ec2-user#ip-10-195-205-30 tmp]$ wget http://10.195.205.30/
--2012-03-07 15:46:08-- http://10.195.205.30/
Connecting to 10.195.205.30:80... failed: Connection refused.
[ec2-user#ip-10-195-205-30 tmp]$
The standard tcp sockets interface requires that you bind to a particular IP address when you send or listen. There are a couple of somewhat special addresses: localhost (which you're probably familiar with) which is 127.0.0.1. There's also a special address, 0.0.0.0 or INADDR_ANY (internet protocol, special shorthand for ANY ADDRESS). It's a way to listen on ANY or more commonly, ALL addresses on the host. This is a way to tell the kernel/stack that you're not interested in a particular IP address.
So, when you're setting up a server that listens to "localhost" you're telling the service that you want to use the special reserved address that can only be reached by users of this host, and while it exists on every host, making a connection to localhost will only ever reach the host you're making the request from.
When you want a service to be reachable everywhere (on a local host, on all interfaces, etc.) you can specify 0.0.0.0.
(0) It's silly but the first thing you need to do is to make sure that your web server is running.
(1) You need to edit your Security Group to let incoming HTTP packets access your website. If your website is listening on port 80, you need to edit the Security Group to open access to port 80 as mentioned above. If your website is listening on some other port, then you need to edit the Security Group to access that other port.
(2) If you are running a Linux instance, the iptables firewall may be running by default. You can check that this firewall is active by running
sudo service iptables status
on the command line. If you get output, then the iptables firewall is running. If you get a message "Firewall not running", that's pretty self-explanatory. In general, the iptables firewall is running by default.
You have two options: knock out the firewall or edit the firewall's configuration to let HTTP traffic through. I opted to knock out the firewall as the simpler option (for me).
sudo service iptables stop
There is no real security risk in shutting down iptables because iptables, if active, merely duplicates the functionality of Amazon's firewall, which is using the Security Group to generate its configuration file. We are assuming here that Amazon AWS doesn't misconfigure its firewalls - a very safe assumption.
(3) Now, you can access the URL from your browser.
(4) The Microsoft Windows Servers also run their personal firewalls by default and you'll need to fix the Windows Server's personal firewall, too.
Correction: by AWS default, AWS does not fire up server firewalls such iptables (Centos) or UAF (Ubuntu) when you are ordering the creation of new EC2 instances - That's why EC2 instances that are in the same VPC can ssh into each other and you can "see" the web server that you fired up from another EC2 instance in the same VPC.
Just make sure that your RESTful API is listening on all interfaces i.e. 0.0.0.0:portID
As you are getting connection refused (packets are being rejected) I bet it is iptables causing the problem. Try to run
iptables -I INPUT -p tcp --dport 80 -j ACCEPT
iptables -I INPUT -p tcp --dport 8888 -j ACCEPT
and test the connection.
You will also need to add those rules permanently which you can do by adding the above lines into ie. /etc/sysconfig/iptables if you are running Red Hat.
Apparently I was "binding to localhost" whereas I needed to bind to 0.0.0.0 to respond to port 80 for the all incoming TCP interfaces (?). This is a subtlety of TCP/IP that I don't fully understand yet, but it fixed the problem.
Had to do the following:
1) Enable HTTP access on the instance config, it wasn't on by default only SSH
2) Tried to do nodejs server, so port was bound to 80 -> 3000 did the following commands to fix that
iptables -F
iptables -I INPUT -p tcp --dport 80 -j ACCEPT
sudo service iptables-persistent flush
Amazon support answered it and it worked instantly:
I replicated the issue on my end on a test Ubuntu instance and was able to solve it. The issue was that in order to run Tomcat on a port below 1024 in Ubuntu/Unix, the service needs root privileges which is generally not recommended as running a process on port 80 with root privileges is an unnecessary security risk.
What we recommend is to use a port redirection via iptables :-
iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 80 -j REDIRECT --to-port 8080
I hope the above information helps.
I just started experiment with EC2 tonight, and got a server running locally. I know it works locally because when I curl http://localhost:8080/hello it outputs hello.
I want to access this from the outside world. I modified my permissions in my security group to allow 8080 access, and then typed in "curl http://ec2-123-45-67-891.compute-1.amazonaws.com:8080/hello" into my local terminal. I got the response "curl: (7) couldn't connect to host".
Do I need to do something differently? (Obviously yes, but what?)
Have you bound your server only to localhost? If so, you'll only be able to connect from localhost.
Check the netstat output for your process with something like:
sudo netstat -ltnp | grep your_server_process
Look for whether your server process is bound to 127.0.0.1:8080 or 0.0.0.0:8080. If the former, then you're only bound to localhost and you need to reconfigure it.
I met the same issue. Try use 0.0.0.0 instead of 127.0.0.1.
You allowed access on 8080, but in your localhost example, it's running on port 80.