An unreachable EC2 instance is nearly always a networking configuration issue — security groups, network ACLs, or routing — rather than the instance itself being “broken”, especially if it still shows as “running” in the console.
Common Symptoms
- SSH/RDP connection times out
- Ping to the public IP fails
- Instance shows “running” and passing status checks in the console, but is still unreachable
Possible Causes
- Security group missing an inbound rule for the required port
- Instance has no public IP, or the Elastic IP was released
- Network ACL blocking the traffic
- The instance’s own OS-level firewall blocking the port
Before You Begin
Check the two status checks (system status and instance status) in the EC2 console first — if either shows a failure, the problem is infrastructure-level, not networking configuration.
Method 1 — Check the security group
Review inbound rules
Open the instance’s security group and confirm an inbound rule allows the port you’re connecting on (22 for SSH, 3389 for RDP) from your current IP address.
Method 2 — Confirm the instance has a public IP
Check networking details
In the instance details panel, confirm a Public IPv4 address is assigned — instances in a private subnet, or ones that lost an Elastic IP association, won’t have one.
Method 3 — Check the subnet’s network ACL
Review ACL rules
Network ACLs apply at the subnet level in addition to security groups — confirm the ACL isn’t blocking the same port with a deny rule.
Method 4 — Check the OS-level firewall via the console
Use EC2 Serial/Session Manager if SSH is unavailable
If you can’t SSH in at all, use AWS Systems Manager Session Manager (if configured) or the EC2 Instance Connect browser terminal to check the OS firewall status without needing inbound SSH access.
Frequently Asked Questions
Why did SSH work yesterday but not today, with no config changes?
Check whether the instance was stopped and restarted — unless you’re using an Elastic IP, a standard public IP address changes every time an instance is stopped and started again.
Conclusion
Security group rules, public IP assignment, and network ACLs account for the large majority of “unreachable but running” EC2 instances — check all three before assuming the instance itself has failed.
Related Articles
