Can't establish internet connection to my EC2 instance [deployed with terraform and 80 http port opened for ACL, Security Group, Internet GW]

0
votes

I have created an EC2 instance with terraform aws provider. The Instance is an Ubuntu server of free tier t2.micro.

Even though I have followed every Amazon guide about Network ACLs, Security Groups, Route tables, Internet gateways, I still cannot execute a simple command such as

sudo apt-get update

When I log in to my instance from ssh port (22) and execute the sudo command above, I receive back this message:

0% [Connecting to us-east-2.ec2.archive.ubuntu.com (52.15.159.198)]

Resources I have followed:

  1. https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ec2-instance-connect-set-up.html?icmpid=docs_ec2_console#ec2-instance-connect-setup-security-group

  2. https://docs.aws.amazon.com/vpc/latest/userguide/VPC_Internet_Gateway.html#vpc-igw-internet-access

  3. https://docs.aws.amazon.com/vpc/latest/userguide/vpc-network-acls.html#nacl-rules

  4. https://docs.aws.amazon.com/vpc/latest/userguide/VPC_SecurityGroups.html#AddRemoveRules

And many SO questions.

Note that I connect with ssh to port 22 and ping the public ip of ec2 instance. I have also created a route table which has an internet gateway attached to network interface.

Network rules:

inbound acl rules

outbound acl rules

Security group rules:

inbound sg rules

outbound sg rules

Route table attached to my instance

enter image description here

My only concern is that the vpc I use has a main acl network (like a default) which is not the one I use (the one with the many rules in the screenshot above). However, the main route table guides to the correct subnet that is also attached to the correct acl network. I guess this is happening because in terraform I use the aws_network_acl resource and not the aws_default_network_acl.

Thus, my only concern might be that I have a wrong acl network attached to my vpc, however even that acl network has allowed all inbound - outbound traffic. So accessing http shouldn't impose a problem. Since I can't download anything from my ec2 instance, I believe that something else is the root of my problem.

Appreciate any help in advance.

Terraform code

amazon-web-serviceshttpamazon-ec2terraformterraform-provider-aws
Please do not use images. – Marko E
Do you think you could post the Terraform code that you used? – Michael
@MarkoE yeah I know it becomes TLDR, I will keep that note. – NikSp
@Michael I will post the terraform code, but I warn you it's long. I will probably upload a txt saved in a my google drive – NikSp
Your screenshot for Outbound Security Group rules shows only certain ports listed. The default is normally "Allow All" on every port. This can be useful for some services that use multiple port ranges (eg FTP). The fact that you can connect to the instance, but the instance is having trouble connecting outwards suggests the problem lies in either the Outbound Security group, or in the NACLs. – John Rotenstein