Websocket timeouts using AWS Application Load Balancer

Question

I'm getting gateway time-outs when trying to use a port specifically for websockets using an Application Load Balancer inside an Elastic Beanstalk environment.

The web application and websocket server is held within a Docker container, the application runs fine however wss://domain.com:8080 will just time out.

Here is the Load balancer listeners, using the SSL cert for wss.

The target group it points to is accepting 'Protocol' of HTTP (I've tried HTTPS) and forwards to 8080 onto an EC2 instance. Or.. It should be. (Doesn't appear to be an option for TCP on Application Load Balancers).

I've had a look over the Application Load Balancer logs and it looks like the it reaches the target group, but times out between it's connection to the EC2 instance, and I'm stumped on why.

All AWS Security Groups have been opened on all traffic for the time being, I've checked the host and found that the port is open and being listened to by Nginx which will route to the correct port to the docker container:

docker ps also shows me:

And once inside the container I can see that the port is being listened to by the Websocket server:

So it can't be the EC2 instance itself, can it? Is there an issue routing websockets via ports in an ALB?

-- Edit --

Current SG of the ALB:

The EC2 instance SG:

Answer 1

Accepted answer here seems to be "open Security Groups for EC2 (web server) and ALB inbound & outbound communication on required ports since websockets need two way communication."

This is incorrect and the reason why it solved the problem is coincidental.

Let me explain:

"Websockets needs two way communication..." - Sure but the TCP sessions is only ever opened from one way - from the client.

You don't have to allow any outbound connections from the EC2 instance (web server) in order to use web sockets.

Of course the ALB needs to be able to do TCP connections to the EC2 instance. But not to the client. Why? Well the ALB is accepting TCP connections (usually on port 80 and 443). It is setting up a TCP session that was initiated by the client. It is then trying to set up a new TCP session to the web server behind the ALB. This should be done on the port that you decided to have the web server listening on. The Security Group around the ALB needs to be able to do outbound connections on this port to the web server. This is the reason why "open up everything" worked. It has nothing to do with "two way communication".

You could use any ports of course but you don't need to use any other ports than 80 & 443 (such as 8080) on both the Load Balancer or the EC2.

Answer 2

Websockets need two way communication, make sure security groups attached to all resources (EC2 & ALB) allow both inbound & outbound communication on required ports.