When an app runs on EC2 but can't be reached from the internet, the request is being blocked somewhere between the browser and the process. The most common causes are security group rules that don't allow the port, an app listening only on localhost, an operating system firewall, networking that doesn't route public traffic to the instance, or DNS pointing to an old IP address. Testing each layer in order finds the block quickly.
Typical symptoms | Browser timeouts, connection refused, works inside the server only, broke after restart, domain not resolving to the app |
Most common causes | Security group rules, localhost binding, OS firewall, subnet or route table setup, changed public IP, app not running as a service |
How we fix it | Test each network layer from app to internet, fix rules and bindings, make the app persistent, verify from outside AWS |
Turnaround | Same-day diagnosis; most fixes in 24–48 hours |
Price | Live Debug from $20; fixed-price quote for the full fix |
Signs Your EC2 App Has This Problem
The browser shows ERR_CONNECTION_TIMED_OUT for the public IP or domain
The app responds to requests from inside the instance
Connection refused on the app's port
The site worked until the instance was stopped and started
The app stops working when you close your SSH session
A load balancer shows unhealthy targets
HTTP works but HTTPS doesn't, or the other way around
Why Your EC2 App Isn't Reachable
A request to your app passes through DNS, AWS networking, the instance's security group, the operating system, and finally your application. A problem at any layer stops it, and timeouts look the same no matter which layer is responsible.
1. Security group doesn't allow the port
Security groups block all inbound traffic unless a rule allows it. Apps on ports like 80, 443, 3000, or 8000 are unreachable until inbound rules permit that port from the right sources.
2. The app listens only on localhost
Many frameworks default to 127.0.0.1, which accepts connections only from inside the instance. The app needs to listen on all interfaces or sit behind a web server that does.
3. Operating system firewall
Firewalls such as ufw or firewalld on the instance can block ports even when the security group allows them.
4. Networking doesn't route public traffic
An instance in a private subnet, without a public IP, or with a route table that doesn't point to an internet gateway can't receive traffic from the internet. Network ACLs can also block traffic at the subnet level.
5. Changed IP address or stopped process
Without an Elastic IP, the public IP changes when an instance stops and starts, leaving DNS pointing to the old address. Apps started manually in an SSH session also stop when that session ends.
How We Diagnose the Unreachable App
Test from inside the instance. Confirm the app responds locally on its port.
Check the listening address. Verify whether the app listens on localhost or all interfaces.
Review security group rules. Check inbound rules for the app's ports and allowed sources.
Check the OS firewall. Confirm the instance firewall allows the same ports.
Verify networking. Review public IP or Elastic IP, subnet, route table, internet gateway, and network ACLs.
Check DNS and load balancers. Confirm DNS points to the current address and load balancer health checks pass.
How We Fix It
Root cause | Fix |
Blocked port | Add precise inbound security group rules for required ports |
Localhost binding | Bind the app correctly or place it behind Nginx as a reverse proxy |
OS firewall | Allow required ports in the instance firewall |
Networking issues | Correct subnet, route table, internet gateway, or network ACL configuration |
IP changed after restart | Attach an Elastic IP and update DNS records |
App stops after SSH logout | Run the app as a managed system service that starts on boot |
We verify access from outside AWS, over HTTP and HTTPS, and after an instance reboot.
Example Fix
Situation: A startup deployed a Node.js API on EC2 for their mobile app. It worked while the developer was connected by SSH, but the app couldn't reach it, and it went down completely after an instance restart.
Cause: The API listened only on localhost, the security group allowed SSH but not web traffic, the app had been started manually in the terminal, and the public IP changed after the restart.
Fix: Put the API behind Nginx on ports 80 and 443, added the correct security group rules, set up HTTPS, ran the API as a system service, and attached an Elastic IP with updated DNS.
Result: The mobile app connected reliably over HTTPS, and the API stayed available after reboots.
How to Keep It From Happening Again
Use an Elastic IP or load balancer for any server your DNS points to.
Run apps as managed services never from an open terminal session.
Define infrastructure as code so security groups and networking are reviewed and repeatable.
What You Get
Root cause confirmed and explained
App reachable over HTTP and HTTPS
Persistent service that survives reboots
Documented network and security settings
Frequently Asked Questions
Why can't I access my EC2 instance from the browser?
Usually the security group doesn't allow the port, the app listens only on localhost, or a firewall blocks it. Networking settings and DNS can also prevent traffic from reaching the instance.
Why does my app work on localhost inside EC2 but not on the public IP?
The app is likely bound to 127.0.0.1, which only accepts connections from inside the server. It must listen on all interfaces or run behind a reverse proxy.
Why did my EC2 site stop working after restarting the instance?
Without an Elastic IP, the public IP changes after a stop and start, and apps started manually don't restart automatically.
Is it safe to open ports in the security group?
Open only the ports your app needs, such as 80 and 443, and restrict administrative access like SSH to known IP addresses.
Do you need full access to our AWS account?
No. Limited permissions for the instance, networking, and DNS are usually enough to diagnose and fix access problems.
Related Problems
Django 502 Bad Gateway
Docker container exits immediately
Node.js app crashing in production
React app blank page after deployment
GitHub Actions pipeline failing
Make Your App Reachable
Share what happens when you open the app and how it's deployed. Get a diagnosis and a fixed price.