How to Fix NLB Endpoint Unreachable on AWS

Select Language:

If your Network Load Balancer (NLB) isn’t accessible and your EC2 instance can’t reach it, don’t worry—this is a common issue, especially when you’re just starting out with AWS. Here’s a step-by-step guide to troubleshoot and hopefully resolve the problem.

First, verify that your NLB is properly set up with two availability zone subnets and that your listener is configured correctly for TCP port 8080. Since you’re using two targets—your EC2 instance on ports 8080 and 8000—they appear to be healthy, which is a good sign. However, if the NLB’s endpoint isn’t responding, something else might be missing.

Start by checking that your security groups allow inbound traffic on port 8080. This means your security group attached to the EC2 instance should have rules permitting traffic from the NLB or from the relevant IP ranges, especially since the connection isn’t happening even from within the instance. Also, confirm the security group for the NLB (if applicable) permits outbound traffic to your EC2 instances.

Next, review the network ACLs (Access Control Lists) for the subnets. Ensure they’re not blocking the traffic on port 8080. Sometimes, the default ACL rules might restrict traffic flowing between subnets or from the internet.

Since you mentioned attempting to ping the NLB IP address and getting no response, remember that many load balancer IPs don’t respond to ping (ICMP) requests because they’re not designed for that. So, use tools like curl or telnet to test the connection on port 8080—this helps determine if the port is open and listening.

From your description, a curl -v request to the load balancer timed out, which indicates either the load balancer isn’t forwarding traffic correctly, or it can’t reach your EC2 target. Double-check your target group configuration in the AWS console: ensure your EC2 instance is marked as healthy and that the health checks are passing. Verify that the health check path and port are configured correctly.

It’s also important to confirm that your EC2 instances are correctly configured to accept incoming traffic on port 8080. Sometimes, server firewalls or application settings can prevent incoming connections, even if security groups are set up correctly.

Lastly, even if your main architecture depends on API Gateway to reach your NLB, testing connectivity directly between your EC2 instance and the NLB can give you critical insights. This kind of troubleshooting helps pinpoint where the traffic is getting lost.

Since you’re new to AWS and networking, take it step-by-step. Start by confirming security settings, then move on to network ACLs, target health status, and server configurations. This systematic approach will help you identify and fix the issue, ensuring your load balancer can properly route traffic to your EC2 instance.