-1

I've been trying to connect to an AWS RDS (postgres) instance. It is setup to be publicly accessible, and I've checked the inbound and outbound security rules. The port is set to the default of 5432.

I have been trying to open a socket to the endpoint, using:

telnet ****.amazonaws.com 5432

this has been hanging, but when I use a personal VPN I've setup (through digitalocean), the connection succeeds.

I can't think why this would be the case. Can anyone explain?

I've been through the amazon troubleshooting page on connecting to an RDS instance, and also tried setting it up in a different region.

I've also tried running tcptraceroute, and the connection seems to get hang on IP's that are owned by 'Amazon EC2 Network Operations'.

image of added rule

fortyfeet
  • 3
  • 2
  • 1
    I've connected to RDS instances over the internet many times. You have to make it publicly accessible (which gives it a public IP address), set up internet gateway, routing, and security group. Maybe try with a psql client rather than telnet – Tim Dec 27 '22 at 07:34
  • Thanks Tim, I have tried with psql. I believe that the rds instance is publicly accessible - certainly the page claims it is and the security group etc are open to all traffic. The port should be open and be accepting connections which when I have my VPN enabled, it does. However, when the VPN isn't enabled - then the socket is never able to connect. I'm wondering if it's anything to do with IP4/6? – fortyfeet Dec 28 '22 at 08:56
  • You would have to post many screenshots from the AWS console for us to be sure.... RDS instance inc SG and showing public enabled, subnet list inc CIDR, route tables, internet gateway, SG details. Otherwise have someone knowledgeable look at your account. It's easy to make small mistakes, AWS is complex. – Tim Dec 28 '22 at 09:20
  • Tim, many thanks for your help. I've tracked down what's blocking it, the security group was setup to allow all inbound traffic, but only with a source of the security group itself. Adding my ip address as a seperate rule has allowed my connection to succeed. What I don't understand is that connecting using private vpn that I've setup that routes traffic through the digital ocean servers appeared to bypass that source rule...? – fortyfeet Dec 29 '22 at 06:15
  • I've added a screenshot of the rule I added in case anyone else has similar issue. – fortyfeet Dec 29 '22 at 06:17
  • Not enough information to say for sure, but my best guess is your VPN is terminated by something that shares that security group. I'll put the answer in so you can mark it solved. – Tim Dec 29 '22 at 07:10

1 Answers1

0

You would have to post many screenshots from the AWS console for us to be sure:

  • RDS instance including security group and showing public enabled
  • Subnet list including CIDR ranges
  • Route tables
  • Internet gateway
  • Security group details including rules

Best guess is the security group is not set up correctly, as you confirmed in comments above.

Tim
  • 31,888
  • 7
  • 52
  • 78