Ssh – Running SSH on different port (RHEL EC2 instance)

amazon ec2amazon-web-servicesssh

So I've done this a few dozen times on a 'normal' box (not in EC2) and it seems simple enough. I was trying to run ssh on port 22 and 80 but I couldn't, for the life of me, figure out why I can't connect through port 80 but I can connect fine using port 22. So here's what I've done:

  1. Create a fresh instace (I used a smaller RHEL instance since I was trying to implement it for a RHEL HVM instance)
  2. SSH into the machine and update /etc/ssh/sshd_config and added the lines Port 22 and Port 80
  3. Added a new rule to the iptables: iptables -I INPUT 3 -s 0.0.0.0/0 -d 0.0.0.0/0 -p tcp --dport 80 -m state --state New -j ACCEPT then sudo service iptables restart
  4. run services sshd restart

The restart says 'OK' and I'm able to connect using port 22. But I cannot connect through port 80. Then I install nmap but don't see anything running on port 80 (port 22 is there!). I am 200% sure that my security group is correct. I've even tried it in a new instance just in case the security groups didn't update in realtime.

A few things I've observed:

  1. stopping iptables and ip6tables service has no effect
  2. if I remove Port 22 from the sshd_config, I can no longer make new connections
  3. If I do the same steps (minus the iptables rule) on an Ubuntu AMI, I can successfully connect!

UPDATE:
I still haven't found the problem but it's most likely caused by my ISP (maybe they're blocking traffic from port 80 that isn't HTTP traffic). Its not secret that Singapore is doing a lot of traffic filtering so its not impossible. I tried running SSH from a different port and that works. Also, connecting to SSH in port 80 from another EC2 instance from a different region works. So anyway, I've marked the most upvoted answer.

Best Answer

Do you have port 80 defined in the security group which the instance belongs to? Below is an example how it may look:

enter image description here

By the way, I do it a bit different way. Perhaps, you will find it useful. I use iptables and DNAT target to forward SSH without touching SSH server configuration:

iptables -t nat -A PREROUTING -m tcp -p tcp --dport 80 -j DNAT --to-destination INSTANCE_IP:22

Additionally, you have to add another rule to allow traffic to port 80.

iptables -A INPUT -m tcp -p tcp --dport 80 -j ACCEPT
Related Topic