Can\'t access the EC2 instance remotely答案

【问题标题】：Can't access the EC2 instance remotelyCan\'t access the EC2 instance remotely
【发布时间】：2022-12-26 19:21:12
【问题描述】：

I'm trying to connect my friend's MySQL database remotely but I'm getting connection timeout error. I tried to ssh. But same result.

Then I check that instance. It has public IP. Also allowed 3306 and 22 ports on the security group. Allowed 100th rule for all sources in subnet NACL.

What I'm missing? Is there any other way to block those traffic? Can anyone help me? I'm a still beginner

【问题讨论】：

Could you provide some pictures of your instance configuration as well as the security group inbound/outbound settings?
Typically, it is best to leave all NACL rules at their default "Allow All" setting unless you have a very specific need (eg creating a DMZ).
I presume that the MySQL database is running on an Amazon EC2 instance? Is your friend able to connect to it 'remotely' too? Can either of you successfully SSH into the EC2 instance?
@JohnRotenstein No, my friend also can't access it remotely. Only both of us can access within the vpc.

标签： amazon-web-services amazon-ec2 aws-security-group

【解决方案1】：

When an SSH connection times-out, it is normally an indication that network traffic is not getting to the Amazon EC2 instance.

Things to check:

The instance is runningLinux
The instance is launched in apublic subnet, which is defined as having a Route Table entry to points to an Internet Gateway
The instance has apublic IP address, which you are using for the connection
TheNetwork Access Control Lists(NACLs) are set to their default "Allow All" values
ASecurity Groupassociated with the instance that permits inbound access on port 22 (SSH) either from your IP address, or from the Internet (0.0.0.0/0)
Yourcorporate networkpermits an outbound SSH connection (try alternate networks, eg home vs work vs tethered to your phone)

Based on your descriptions, I would suggest checking whether the instance was launched in apublic subnet.

【讨论】：

【解决方案2】：

I found the reason. That instance was deployed in a private subnet and didn't have inbound access.

Solution:- I deployed a bastion host in a public subnet and used SSH agent forwarding to access the instance through the bastion host.

【讨论】：