Alibaba Cloud account recharge: IP cannot be accessed? 5-minute quick troubleshooting and resolution guide
In the process of using Aliyun ECS cloud server, many users have encountered such problems:
Alibaba Cloud account recharge
The server has been started, and the public network IP can be seen normally in the console, but the access through the browser has been timed out, SSH connection is not available, and even the Ping command has not responded.
In this case, the first reaction of many people is that the server is out of order, and even suspect that the public network IP is blocked. Actually, that’s not necessarily the case. There are many reasons why Aliyun IP cannot be accessed. It may be that the security group is configured incorrectly, or the internal firewall of the server is blocked, the port is not started, or the public network is abnormal.
If you encounter similar problems, don't rush to reinstall the system or replace the server. The following is based on the common troubleshooting ideas in actual operation and maintenance, starting from the simplest place to check, usually within a few minutes to find the problem.
1. first confirm whether the Alibaba Cloud server is running normally
This is the first step in the investigation, and it is also the most easily overlooked place.
Log on to the Alibaba Cloud official website, go to the ECS console, find the corresponding instance, and check the following information:
Whether the instance running status is displayed as Running 」.
Has a public IP address been assigned?
Whether the instance has overdue fees, downtime, or other abnormal prompts.
Whether the current public IP address is consistent with the IP address accessed by the user.
In particular, pay attention to the change of public network IP.
Alibaba Cloud account recharge
The IP address used by some users may have changed after restarting the server, changing the network configuration, or recreating the instance.
If you are using a pay-as-you-go ECS instance, it is recommended to check the account balance and resource status at the same time to avoid service impact due to arrears.
After confirming that the instance status is normal, proceed to the next step.
2. check the security group rules, the most common problems are here
If the Alibaba Cloud server can operate normally, but the external network cannot be accessed, you should first check the security group.
A security group is a network firewall for an ECS, which determines which IP addresses can access the ECS through which ports.
For example:
The website uses the HTTP protocol and needs to open TCP port 80.
The website uses the HTTPS protocol and needs to open the TCP 443 port.
Linux server SSH remote connection, usually using TCP port 22.
Windows Server Remote Desktop, typically using TCP port 3389.
Specific steps:
Log on to the Alibaba Cloud ECS console.
Find the corresponding server instance.
Go to the instance details and find the security group configuration.
Click the security group ID to go to the rule management page.
Check whether the inbound rules allow access to the corresponding port.
If there are no relevant rules, you can add them based on the actual business.
For example, the website needs to open 80 ports, you can set:
Direction: incoming direction
Authorization Policy: Allow
Protocol Type: TCP
Port range: 80/80
Authorized object: Enter the trusted source IP address based on business needs.
If the site is opened at the same time
With HTTPS, you also need to configure the 443 port.
Here is a reminder: don't directly open all ports to the entire Internet for convenience. Especially for remote management ports such as 22 and 3389, it is recommended to restrict source IP addresses and allow only common network access.
If you are not sure which rule has the problem, you can also use the security group rule diagnosis function provided by the Alibaba Cloud console to check it.
3. check server internal firewall
Some users will find that the security group in the Aliyun console has allowed the port, but the public IP is still inaccessible.
At this time, it is necessary to check the firewall of the server operating system itself.
Security groups and system firewalls are two different security mechanisms. Even if the cloud platform allows traffic to enter, if the firewall inside the server blocks the request, external users still cannot connect normally.
If you are using a Linux system, you can run the following command to check the firewall status:
systemctl status firewalld
If you are using an Ubuntu system, you can also check UFW:
ufw status
When you need to open port 80, you can add rules based on the actual situation of the system.
CentOS, Rocky Linux, and other systems that use Firewalld:
firewall-cmd --permanent --add-port=80/tcp
firewall-cmd --reload
Systems using UFW on Ubuntu:
ufw allow 80/tcp
If the website uses HTTPS, you also need to release the 443 port according to the actual situation.
Note: The firewall configuration of different Linux distributions may be different. It is not recommended to directly turn off the entire firewall for troubleshooting. The correct approach is to find the intercepted port, and then targeted release.
4. check whether the service port is actually started
This is another problem that is more easily encountered.
Sometimes there is no problem with the server network and the security group is configured correctly,
Alibaba Cloud account top-up
The website still cannot be opened. The reason may be that Nginx, Apache, or other application services are not running properly.
Take a Linux server as an example:
ss -tlnp
View the TCP port on which the system is currently listening.
If your site uses port 80, you should normally see something like the following:
LISTEN 0 511 0.0.0.0:80
If there is no 80 port listening information, you need to check whether the Web service is started.
For example, to view the Nginx running status:
systemctl status nginx
If the service does not start, you can try:
systemctl start nginx
If Nginx fails to start, do not restart it repeatedly. It is recommended to view the error log:
