修改Classic ELB入站安全组后EC2实例无法连接其80端口求助

I've run into this exact scenario with Classic ELBs before—here's what's going on and how to fix it step by step:

1. The Core Issue: Public vs. Private IP Traffic Matching #

When your EC2 instance (in a public subnet) connects to the ELB's public DNS, it's sending traffic over the public internet. That means the source IP visible to the ELB is your EC2's public IP address, not its private VPC IP.

But when you set the ELB's inbound security group source to your EC2's security group (sg-****), that rule only allows traffic from instances in that security group using their private VPC IPs. Public IP traffic doesn't match this rule, so it gets blocked—hence the timeout.

Fix Options for This: #

• Use the ELB's private DNS for internal access
  Classic ELBs automatically get a private DNS entry (format: internal-classic2-**.us-east-1.elb.amazonaws.com). Have your EC2 connect to this instead of the public DNS. Traffic will stay within your VPC, using private IPs, so it will match the security group rule. Test it with:

  telnet internal-classic2-**.us-east-1.elb.amazonaws.com 80
  

• Add your EC2's public IP to the ELB security group
  If you need to use the public DNS, add an extra inbound rule to the ELB's security group: TCP port 80, source set to your EC2's public IP (e.g., x.x.x.x/32). This explicitly allows the public IP traffic through.

2. Double-Check Security Group Configuration Details #

• Use the security group ID instead of the name
  Sometimes security group names can be duplicated across regions or accounts. Instead of selecting by name, paste the EC2's security group ID (sg-****) directly into the ELB's inbound rule source field to avoid mismatches.
• Confirm both resources are in the same VPC
  Cross-VPC security group references don't work with Classic ELBs (even with peering). Make sure your EC2 and ELB are deployed in the exact same VPC.

3. Verify EC2 Outbound Rules (Quick Check) #

While your initial test worked, it's worth confirming your EC2's security group allows outbound TCP traffic on port 80. Most default security groups allow all outbound traffic, but if you've locked it down, ensure there's a rule permitting access to either 0.0.0.0/0 (all destinations) or the ELB's IP ranges.

4. Optional: Check ELB Health Status #

Though this isn't the root cause of your timeout, it's a good sanity check. Head to the AWS Console, navigate to your ELB, and confirm that backend instances show as "Healthy". If they're unhealthy, that could cause other issues later, but your current timeout is definitely a security group rule problem.

内容的提问来源于stack exchange，提问作者Phil