New AWS EC2 outbound traffic issue

amazon ec2amazon-web-services

I have been following a tutorial on LinuxAcademy to setup a VPC and EC2 instance. I have done everything correctly and launched the instance and then ssh into it, I then tried to update yum and got this error:

Could not retrieve mirrorlist http://repo.us-east-2.amazonaws.com/latest/main/mirror.list error was
12: Timeout on http://repo.us-east-2.amazonaws.com/latest/main/mirror.list: (28, 'Connection timed out after 5001 milliseconds')


 One of the configured repositories failed (Unknown),
 and yum doesn't have enough cached data to continue. At this point the only
 safe thing yum can do is fail. There are a few ways to work "fix" this:

     1. Contact the upstream for the repository and get them to fix the problem.

     2. Reconfigure the baseurl/etc. for the repository, to point to a working
        upstream. This is most often useful if you are using a newer
        distribution release than is supported by the repository (and the
        packages for the previous distribution release still work).

     3. Disable the repository, so yum won't use it by default. Yum will then
        just ignore the repository until you permanently enable it again or use
        --enablerepo for temporary usage:

            yum-config-manager --disable <repoid>

     4. Configure the failing repository to be skipped, if it is unavailable.
        Note that yum will try to contact the repo. when it runs most commands,
        so will have to try and fail each time (and thus. yum will be be much
        slower). If it is a very temporary problem though, this is often a nice
        compromise:

            yum-config-manager --save --setopt=<repoid>.skip_if_unavailable=true

Cannot find a valid baseurl for repo: amzn-main/latest

So I have double checked the following:

  • have public elastic ip

  • IGW setup

  • public subnets setup and the ACL has ALL outbound traffic allowed on
    0.0.0.0/0

  • security group is allowing all outbound traffic

Finally, while I was looking at these settings I was discontented from the instance and now when I try to ssh back in it just times out, also I cannot ping the ip remotely.

I have also tried rebooting the instance but that didnt help.

Edit: Here are my screenshots and also a diagram from the tutorial of what I am trying to setup

sec_g1

sec_g2

sec_g3

NACL1

NACL2

NACL3

Diagram

Best Answer

Your issue is with your NACLs. You allow inbound on only on port 22/tcp and 80/tcp.

When you make a web connection its outbound on port 80 or 443 but it comes back at a random high port. Security groups are sort of stateful and will allow return connections but not network ACLs.

If you allow 1024-65535/tcp your web connections should work.

Related Topic