I just created a brand new EC2 instance with a default security group allowing All Traffic from Anywhere.

My listen_address is set to *

I can SSH to it but I can't connect to the pgsql instance running inside it, UNLESS I change the port to something other than port=5432.

This Setup Fails:

postgresql.conf: port=5432 psql -h <public-ip> -p 5432


psql: could not connect to server: Operation timed out`

This works:

port=6000 psql -h <public-ip> -p 6000

I tried this twice in two different AWS accounts, same behavior.

no iptables rules are present either, it's a brand new EC2 instance:

ubuntu@<public-ip>:~$ sudo iptables -L -n
Chain INPUT (policy ACCEPT)
target     prot opt source               destination

Chain FORWARD (policy ACCEPT)
target     prot opt source               destination

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination

This doesn't make sense to me at all.

This is the version of Ubuntu I'm running:

ubuntu@<public-ip>:~$ lsb_release -a
No LSB modules are available.
Distributor ID: Ubuntu
Description:    Ubuntu 14.04.2 LTS
Release:    14.04
Codename:   trusty

Postgres version:

psql (PostgreSQL) 9.3.6

The weirdest thing it was working yesterday, no changes has been made except that I upgraded to Yosemite 10.10.3 (14D136.


I checked with another EC2 instance in the cloud as client, it connect, it seems to be my OSX, again, since I updated to Yosemite 10.10.3


Not just psql, none of my client apps are able to connect.


"host=<public-ip> port=5432 sslmode=disable" didn't worked neither.

Any tips?

  • Check this out. – Vérace Apr 19 '15 at 19:37
  • @Vérace thanks for the comment, but it doesn't work. I also commented out ssl = true in postgresql.conf, nothing. got any other tips? I'm getting desperate. – bithavoc Apr 19 '15 at 23:27

Doing an nmap over the EC2 instance:

nmap -Pnv -p 5432 <public-ip>

revealed that my ISP is intentionally blocking the port 5432(third-world country FTW...):

Host is up.
5432/tcp filtered postgresql

It was never a problem with EC2 nor Postgresql in first place.

| improve this answer | |
  • That was my first thought when it was this specific port. Weird port to block. If you want to properly confirm that it's your ISP, you should use traceroute in TCP mode, or a similar TCP traceroute tool. – Craig Ringer Apr 20 '15 at 0:46

Not the answer you're looking for? Browse other questions tagged or ask your own question.