Home / AWS / Fix AWS EC2 Security Group Blocking Traffic

AWS

Fix AWS EC2 Security Group Blocking Traffic

Resolve security group blocking issues by diagnosing ingress/egress rules, checking rule priorities, and verifying source/destination configurations.

Published: Apr 1, 20267 min readBy FixWikiHub Editorial Team

Abstract illustration for a troubleshooting knowledge base category.

Introduction

Security groups act as virtual firewalls for EC2 instances. When traffic is blocked, instances can't receive inbound connections or send outbound traffic despite network routes being correct. The security group rules don't match your traffic requirements.

Symptoms

Application-level:

bash

$ curl http://10.0.1.50:8080
curl: (7) Failed to connect to 10.0.1.50 port 8080: Connection timed out

SSH connection:

bash

$ ssh ec2-user@ec2-1-2-3-4.compute-1.amazonaws.com
ssh: connect to host ec2-1-2-3-4.compute-1.amazonaws.com port 22: Connection refused

Database connection:

bash

Error: Can't connect to MySQL server on '10.0.2.100' (110)
Connection timed out

Health check failures:

```bash $ aws elbv2 describe-target-health --target-group-arn arn:aws:elasticloadbalancing:...

"TargetHealth": { "State": "unhealthy", "Description": "Target failed health checks" } ```

Common Causes

1.Missing inbound rule - No ingress rule for the required port/protocol
2.Wrong source CIDR - Rule exists but source IP range doesn't include client
3.Missing outbound rule - Egress blocked, instance can't respond
4.Rule priority confusion - Multiple rules, wrong one matching
5.Security group not attached - Instance doesn't have the security group
6.Network ACL overriding - NACL blocking before security group
7.Wrong protocol - TCP rule when UDP needed, or vice versa
8.Port range incorrect - Single port when range needed

Step-by-Step Fix

1.Check logs for specific error messages
2.Verify configuration settings
3.Test network connectivity
4.Review recent changes
5.Apply corrective action
6.Verify the fix

Step 1: Identify Instance Security Groups

```bash # Get instance's security groups aws ec2 describe-instances --instance-ids i-abc123 \ --query 'Reservations[*].Instances[*].SecurityGroups[*].[GroupId,GroupName]'

# Or by name aws ec2 describe-instances --filters Name=tag:Name,Values=my-server \ --query 'Reservations[*].Instances[*].SecurityGroups[*].GroupId' ```

Step 2: Review Security Group Rules

```bash # Get all inbound rules (ingress) aws ec2 describe-security-groups --group-ids sg-12345 \ --query 'SecurityGroups[*].IpPermissions'

# Get all outbound rules (egress) aws ec2 describe-security-groups --group-ids sg-12345 \ --query 'SecurityGroups[*].IpPermissionsEgress'

# Get rules in formatted table aws ec2 describe-security-groups --group-ids sg-12345 \ --query 'SecurityGroups[*].IpPermissions[*].[FromPort,ToPort,IpProtocol,IpRanges[*].CidrIp]' \ --output table ```

Step 3: Test Connectivity from Source

```bash # Test from outside AWS (your local machine) curl -v --connect-timeout 5 http://INSTANCE_PUBLIC_IP:8080

# Test from another EC2 instance in same VPC aws ec2 describe-instances --instance-ids i-test123 --query 'Reservations[*].Instances[*].PrivateIpAddress'

# SSH to test instance and try connection ssh test-instance curl -v http://10.0.1.50:8080

# Check what source IP you're connecting from curl http://checkip.amazonaws.com ```

Step 4: Check for Missing Inbound Rule

bash # Check if specific port is open aws ec2 describe-security-groups --group-ids sg-12345 \ --query 'SecurityGroups[*].IpPermissions[?FromPort==8080`]'

# Check if port 22 (SSH) is allowed aws ec2 describe-security-groups --group-ids sg-12345 \ --query 'SecurityGroups[*].IpPermissions[?FromPort==22 && IpProtocol==tcp]'

# If missing, add the rule aws ec2 authorize-security-group-ingress \ --group-id sg-12345 \ --protocol tcp \ --port 8080 \ --cidr 10.0.0.0/16 # Or specific source IP ```

Step 5: Verify Source CIDR Matches

```bash # Get your source IP SOURCE_IP=$(curl -s http://checkip.amazonaws.com)/32

# Check if your IP is in any rule's CIDR range aws ec2 describe-security-groups --group-ids sg-12345 \ --query "SecurityGroups[*].IpPermissions[*].IpRanges[*].CidrIp"

# If your IP isn't covered, add specific rule aws ec2 authorize-security-group-ingress \ --group-id sg-12345 \ --protocol tcp \ --port 22 \ --cidr $SOURCE_IP

# Or add broader range aws ec2 authorize-security-group-ingress \ --group-id sg-12345 \ --protocol tcp \ --port 22 \ --cidr 203.0.113.0/24 ```

Step 6: Check Outbound (Egress) Rules

```bash # Review egress rules aws ec2 describe-security-groups --group-ids sg-12345 \ --query 'SecurityGroups[*].IpPermissionsEgress[*].[IpProtocol,FromPort,ToPort,IpRanges[*].CidrIp]'

# Default allows all outbound, but may have been restricted # Add outbound rule if needed aws ec2 authorize-security-group-egress \ --group-id sg-12345 \ --protocol tcp \ --port 443 \ --cidr 0.0.0.0/0

# Allow all outbound (restore default) aws ec2 authorize-security-group-egress \ --group-id sg-12345 \ --ip-permissions 'IpProtocol=-1,FromPort=-1,ToPort=-1,IpRanges=[{CidrIp=0.0.0.0/0}]' ```

Step 7: Check Security Group Association

```bash # Verify security group is attached to instance aws ec2 describe-instances --instance-ids i-abc123 \ --query 'Reservations[*].Instances[*].SecurityGroups[*].GroupId'

# Attach security group if missing aws ec2 modify-instance-attribute \ --instance-id i-abc123 \ --groups sg-12345 sg-default

# Replace all security groups on instance aws ec2 modify-instance-attribute \ --instance-id i-abc123 \ --groups sg-12345 sg-67890 ```

Step 8: Check Network ACL Rules

NACLs process before security groups and can block traffic:

```bash # Get subnet's NACL SUBNET_ID=$(aws ec2 describe-instances --instance-ids i-abc123 \ --query 'Reservations[*].Instances[*].SubnetId' --output text)

NACL_ID=$(aws ec2 describe-network-acls \ --filters Name=association.subnet-id,Values=$SUBNET_ID \ --query 'NetworkAcls[*].NetworkAclId' --output text)

# Check NACL rules aws ec2 describe-network-acls --network-acl-ids $NACL_ID \ --query 'NetworkAcls[*].Entries[*].[RuleNumber,Egress,RuleAction,PortRange,CidrBlock]' ```

NACL rules are processed by rule number (lowest first). Ensure: - Inbound ALLOW for required port exists - Outbound ALLOW for ephemeral ports (1024-65535) exists

Step 9: Debug with VPC Flow Logs

```bash # Enable flow logs if not already aws ec2 create-flow-logs \ --resource-type VPC \ --resource-id vpc-12345 \ --traffic-type ALL \ --log-group-name /aws/vpc/flow-logs

# Query flow logs for rejected traffic aws logs filter-log-events \ --log-group-name /aws/vpc/flow-logs \ --filter-pattern "REJECT" \ --start-time $(date -d '10 minutes ago' +%s)000

# Example rejected traffic: # 2 123456789010 eni-abc123 10.0.1.50 203.0.113.100 8080 51532 6 1 100 REJECT OK ```

Step 10: Verify Protocol and Port Range

```bash # Check exact rule configuration aws ec2 describe-security-groups --group-ids sg-12345 \ --query 'SecurityGroups[*].IpPermissions[*].[IpProtocol,FromPort,ToPort]'

# Common protocols: # - tcp: 6 # - udp: 17 # - icmp: 1 # - all: -1

# Add rule for port range aws ec2 authorize-security-group-ingress \ --group-id sg-12345 \ --protocol tcp \ --port 8000-9000 \ --cidr 10.0.0.0/16

# Add ICMP rule (ping) aws ec2 authorize-security-group-ingress \ --group-id sg-12345 \ --protocol icmp \ --port -1 \ --cidr 10.0.0.0/16 ```

Step 11: Check Security Group References

```bash # Rules can reference other security groups instead of CIDR aws ec2 describe-security-groups --group-ids sg-12345 \ --query 'SecurityGroups[*].IpPermissions[*].UserIdGroupPairs[*].[GroupId,UserId]'

# Add rule referencing another security group aws ec2 authorize-security-group-ingress \ --group-id sg-12345 \ --protocol tcp \ --port 3306 \ --source-group sg-67890 \ --group-owner 123456789012

# This allows traffic from any instance with sg-67890 attached ```

Verification

```bash # Test connectivity after fix curl -v http://INSTANCE_IP:8080

# SSH connection ssh -v ec2-user@INSTANCE_PUBLIC_IP

# For ALB target health aws elbv2 describe-target-health --target-group-arn TG_ARN \ --query 'TargetHealthDescriptions[*].TargetHealth.State'

# Should return "healthy" ```

[Fix AWS EC2 Instance Not Responding](/articles/fix-aws-ec2-instance-not-responding)
[Fix AWS ELB Health Check Failing](/articles/fix-aws-elb-health-check-failing)
[Fix AWS VPC Peering Not Working](/articles/fix-aws-vpc-peering-connection-not-working)

[AWS troubleshooting: Fix IAM Permission Denied - Complete Tro](fix-iam-permission-denied)
[AWS cloud troubleshooting: AWS ACM Certificate Pending Validation Because the](aws-acm-certificate-pending-validation-wrong-route53-zone)
[AWS cloud troubleshooting: AWS ALB Returns 502 Because the Target Closed the ](aws-alb-502-target-closed-connection-keepalive-timeout-mismatch)
[AWS cloud troubleshooting: Fix AWS ALB CreateListener TargetGroupNotFound Err](aws-alb-createlistener-targetgroupnotfound)
[AWS cloud troubleshooting: Fix Aws Alb Lambda 502 Bad Gateway Issue in AWS](aws-alb-lambda-502-bad-gateway)

Was this guide helpful?

Related search paths

People also search for

If the symptom is close but not identical, these search paths usually surface the right neighboring fixes faster than scrolling the full archive.

AWS EC2 Security Group Blocking Traffic AWS EC2 Security Group Blocking Traffic AWS AWS EC2 Security Group Blocking Traffic troubleshooting AWS EC2 Security Group Blocking Traffic fix Resolve security group blocking issues by diagnosing ingress/egress rules, checking rule priorities, and verifying source/destination configurations AWS Resolve security group blocking issues by diagnosing ingress/egress rules, checking rule priorities, and verifying source/destination configurations

Explore Related Topics

Browse Guides from Other Categories

Discover troubleshooting guides from related categories to expand your knowledge.

FAQ

AWS Troubleshooting FAQs

Common questions about troubleshooting and preventing similar issues

How do I know if this aws-errors troubleshooting guide applies to my situation?

This guide is designed for aws-errors issues. If you're experiencing similar symptoms described in the article, follow the step-by-step instructions. Start with the most common causes and work through the diagnostic process.

Is it safe to follow these aws-errors troubleshooting steps?

Yes, all steps are designed to be safe and non-destructive. We recommend creating backups before making significant changes and testing each step before proceeding to the next.

How long does it typically take to resolve this type of aws-errors issue?

Most aws-errors issues can be resolved within 30 minutes to 2 hours, depending on the complexity and root cause. Follow the troubleshooting flow to identify and fix the problem efficiently.

How can I prevent this aws-errors issue from happening again?

Regular maintenance, monitoring, and following best practices for aws-errors configuration can help prevent recurrence. Consider implementing automated checks and alerts for early detection.

Written by

FixWikiHub Editorial Team

Our editorial team consists of experienced DevOps engineers, systems administrators, and cloud architects with hands-on experience in production environments across AWS, Azure, GCP, and on-premises infrastructure.

Every guide undergoes technical review for accuracy and is updated when software versions, commands, or best practices change.

Last updated: Apr 1, 2026

About our team

Important Notice

Disclaimer & Safety Guidelines

The troubleshooting steps in this guide are provided for educational and informational purposes. Before applying any changes to production systems:

Test in a staging environment first — Always verify commands and configurations in a non-production environment before deploying to live systems.
Create backups — Ensure you have current backups of databases, configurations, and critical files before making changes.
Understand the impact — Review how each step may affect your specific environment, dependencies, and users.
Consult official documentation — This guide supplements, but does not replace, official vendor documentation and best practices.

FixWikiHub is not responsible for any damages arising from the use of this content. See our Terms of Use for more information.

Resources

Official Documentation & Further Reading

For authoritative information, consult the official documentation for the technologies discussed in this guide. Our troubleshooting content supplements, but does not replace, vendor documentation.

AWS Documentation — Official Amazon Web Services guides and API references
Kubernetes Documentation — Official Kubernetes documentation
Nginx Documentation — Official Nginx web server documentation
Apache Documentation — Official Apache HTTP Server documentation
Docker Documentation — Official Docker container documentation

Fix AWS EC2 Security Group Blocking Traffic

Introduction

Symptoms

Common Causes

Step-by-Step Fix

Step 1: Identify Instance Security Groups

Step 2: Review Security Group Rules

Step 3: Test Connectivity from Source

Step 4: Check for Missing Inbound Rule

Step 5: Verify Source CIDR Matches

Step 6: Check Outbound (Egress) Rules

Step 7: Check Security Group Association

Step 8: Check Network ACL Rules

Step 9: Debug with VPC Flow Logs

Step 10: Verify Protocol and Port Range

Step 11: Check Security Group References

Verification

People also search for

Browse Guides from Other Categories

WordPress

SSL

DNS

AWS Troubleshooting FAQs

FixWikiHub Editorial Team

Disclaimer & Safety Guidelines

Official Documentation & Further Reading

Fix AWS EC2 Security Group Blocking Traffic

Introduction

Symptoms

Common Causes

Step-by-Step Fix

Step 1: Identify Instance Security Groups

Step 2: Review Security Group Rules

Step 3: Test Connectivity from Source

Step 4: Check for Missing Inbound Rule

Step 5: Verify Source CIDR Matches

Step 6: Check Outbound (Egress) Rules

Step 7: Check Security Group Association

Step 8: Check Network ACL Rules

Step 9: Debug with VPC Flow Logs

Step 10: Verify Protocol and Port Range

Step 11: Check Security Group References

Verification

Related Issues

Related Articles

People also search for

Share this guide

More AWS Troubleshooting Guides

Browse Guides from Other Categories

AWS Troubleshooting FAQs

FixWikiHub Editorial Team

Disclaimer & Safety Guidelines

Official Documentation & Further Reading