Home / server / Questions / 853157
Accepted
Petr Mensik
Asked: 2017-06-01 00:27:11 +0800 CST

AWS EC2 instance cannot ping certain address

  • 772

I have encountered strange problem when I was deploying our application to AWS (more precisely Elastic Beanstalk which is based on EC2). We are using certain VOIP provided whose address is vh1107.ipex.cz. Application works normally on localhost (even on different hosting) however on AWS it fails to connect to this address. I also cannot ping it when I log to the instance, however it can ping any other internet address I tried. So what is wrong here? Could this address be on some AWS blacklist?

EDIT

Sorry I've put my question wrongly. I know difference between HTTP and ICMP, the thing is however I can ping it from my own machine so it means that server listens to ICMP and problem is in the AWS. Same goes for any HTTP client, e.g. curl vh1107.ipex.cz/calls -v runs fine on my machine but request hangs on AWS. Our former hosting can reach the server as well.

networking

2 Answers

  1. Best Answer

    That server doesn't respond to ping requests. Ping uses ICMP which many servers block at the firewall.

    A bit more background: ping runs over ICMP (read this article), which is different and separate from the TCP protocol that http/https run over.

    There's generally very little to gain for a website to allow people to ping it, and every way you allow users to access your website or servers introduces risk. I don't allow ICMP into my servers, other than from one specified IP address. Because they're separate protocols it's easy to block ICMP at the firewall. This is why you can't ping some servers.

    Updated

    Based on our conversation in comments, I can verify that the server is rejecting some connections based on location. From the Czech Republic I can connect (though the URL is invalid), from New Zealand or the USA I can't connect.

    I think you'll need a different provider, a VPN, or co-operation from the provider.

    • 1

  2. Have you had a look at the security group that your Elastic Beanstalk application is using? you need to make sure that the security group allows the correct traffic Inbound. here a an extract from AWS Doumentation:

    The security groups attached to your instances determine which traffic is allowed to reach the instances (ingress), and which traffic is allowed to leave the instances (egress). Elastic Beanstalk creates a security group that allows traffic from the load balancer on the standard ports for HTTP (80) and HTTPS (443). You can specify additional security groups that you have created to allow traffic on other ports or from other sources. For example, you can create a security group for SSH access that allows ingress on port 22 from a restricted IP address range or, for additional security, from a bastion host to which only you have access.

    • 0