Fix "Connection Timed Out": How to Open Ports 80 and 443 on Oracle Cloud VPS

Fix "Connection Timed Out": How to Open Ports 80 and 443 on Oracle Cloud Infrastructure (OCI) VPS

The most frustrating moment for developers launching an Oracle Cloud Free Tier instance is completing a fresh Nginx, Apache, or Docker installation, verifying that the web service status is active (running), and then being greeted by a blank ERR_CONNECTION_TIMED_OUT screen in their web browser.

If you have spent hours troubleshooting Nginx virtual hosts, restarting systemd services, or checking domain DNS records to no avail, you are not alone. Oracle Cloud Infrastructure (OCI) is engineered with a strict Security-First architecture. Unlike standard virtual private servers (VPS) where web ports are open by default, Oracle Cloud enforces a mandatory two-layer security firewall. To allow external HTTP (port 80) and HTTPS (port 443) web traffic to reach your server, you must open ports at both the cloud network perimeter and inside the virtual machine's Linux operating system.

If you are setting up an instance for hosting CMS platforms like WordPress, make sure to read our complete step-by-step guide on Setting up WordPress on Oracle Cloud Free Tier.

Need high-performance cloud hosting without the manual firewall configuration headaches? For businesses and developers managing client infrastructure, manual cloud security configurations can lead to unexpected downtime. Discover how RackUp IT provides hassle-free managed hosting in our analysis on Web Hosting for Growing Businesses or explore our Managed Cloud & Web Hosting Services.

The Dual-Firewall Architecture Explained: VCN vs. OS Firewall

Why do standard Linux tutorials fail when applied to Oracle Cloud? The answer lies in Oracle's dual-layer defense model:

1. Layer 1: OCI Virtual Cloud Network (VCN) Ingress Rules: This is the cloud-level perimeter firewall managed via the Oracle Cloud Console. It acts as the outer gate of your cloud datacenter. By default, Oracle blocks all incoming public traffic except SSH (port 22).

2. Layer 2: Guest Operating System Firewall (iptables / netfilter-persistent): This is the internal software firewall running inside your Linux instance (Ubuntu, Debian, or Oracle Linux). Oracle's official OS images come pre-configured with strict iptables rules that reject incoming traffic on unapproved ports—even if you disable ufw!

To successfully serve websites or APIs, traffic must pass through both layers. If either layer remains closed, external requests will result in a connection timeout.

Step 1: Configure OCI Console Ingress Security Rules (Cloud Layer)

First, we must instruct Oracle Cloud Infrastructure's network perimeter firewall to allow inbound TCP packets on web ports 80 and 443.

1. Log into your Oracle Cloud Console.

2. Open the navigation menu and go to Compute > Instances. Click on your active instance name.

3. Under the Instance Details page, scroll down to the Primary VNIC section and click on the link for your Subnet.

4. Inside the Subnet details page, click on your Security List (typically named Default Security List for...).

5. Click the Add Ingress Rules button and fill in the following parameters for HTTP:

   • Source Type: CIDR

   • Source CIDR: 0.0.0.0/0 (Allows traffic from any IP address on the internet)

   • IP Protocol: TCP

   • Source Port Range: (Leave empty)

   • Destination Port Range: 80,443 (or add separate rules for port 80 and port 443)

   • Description: Allow Inbound Web Traffic (HTTP and HTTPS)

6. Click Add Ingress Rules to save changes.

Pro Tip: OCI Security Lists are stateful by default. This means when an incoming HTTP request is allowed in on port 80 or 443, the outbound response is automatically permitted without requiring separate egress rules.

Step 2: Unlock the Guest OS Firewall (Ubuntu / Debian / Oracle Linux)

Now that the cloud perimeter gate is open, we must configure the Linux operating system inside your Virtual Machine to accept traffic on ports 80 and 443. Check out our Managed Shared WordPress hosting

For Ubuntu and Debian Instances

Oracle's official Ubuntu images utilize raw iptables rules managed by netfilter-persistent. Running standard commands like sudo ufw allow 80/tcp often fails because existing iptables REJECT rules take precedence.

Connect to your server via SSH and execute the following commands in sequence:

# Insert ACCEPT rule for Port 80 (HTTP) before the default REJECT rule
sudo iptables -I INPUT 6 -p tcp --dport 80 -j ACCEPT

# Insert ACCEPT rule for Port 443 (HTTPS) before the default REJECT rule
sudo iptables -I INPUT 6 -p tcp --dport 443 -j ACCEPT

# Save the updated iptables rules permanently so they survive server reboots
sudo netfilter-persistent save

# Reload the netfilter-persistent service
sudo netfilter-persistent reload

For Oracle Linux and RHEL Instances

If your instance runs Oracle Linux or Red Hat Enterprise Linux, the default firewall manager is firewalld. Run the following commands via SSH:

# Add HTTP and HTTPS services to the public firewall zone
sudo firewall-cmd --permanent --zone=public --add-service=http
sudo firewall-cmd --permanent --zone=public --add-service=https

# Reload firewalld to apply changes
sudo firewall-cmd --reload

Step 3: Verification & Network Diagnostics

Once both the OCI Console Security List and local OS firewall rules are updated, verify your server's accessibility using these diagnostic steps:

1. Test Local HTTP Listener: Run curl -I http://localhost on your server terminal. You should receive an HTTP/1.1 200 OK or HTTP/1.1 301 Moved Permanently header response.

2. Test Public Connectivity: Open a browser on your local computer or smartphone and visit http://<YOUR_ORACLE_PUBLIC_IP>. If your web server welcome page loads, your ports are officially open!

3. Port Probe Command: From your local computer terminal, run a network probe:

   nc -zv <YOUR_ORACLE_PUBLIC_IP> 80 443

   A successful connection will return Connection to <YOUR_ORACLE_PUBLIC_IP> 80 port [tcp/http] succeeded!

Troubleshooting Common Connection Issues

If you are still experiencing connection failures, check these three common pitfalls:

• Difference Between "Connection Refused" and "Connection Timed Out":

  • Connection Timed Out: Indicates that firewall rules (OCI Security List or OS iptables) are still actively dropping incoming packets. Review Steps 1 and 2.

  • Connection Refused: Means the firewall is open, but no web server daemon (Nginx, Apache, or Docker container) is listening on port 80/443. Run sudo systemctl status nginx or sudo netstat -tulpn | grep LISTEN to confirm your service is running.

• Rules Lost After Server Reboot: If your ports close after restarting your instance, you forgot to save your iptables state. Always run sudo netfilter-persistent save after modifying iptables rules.

• Cloudflare / Proxy Conflicts: If you are routing traffic through Cloudflare, ensure your DNS A record is pointed to the correct Oracle Public IP and that your Cloudflare SSL/TLS setting is set to Full or Full (Strict).

How to Check and Open Ports on Any VPS

The same rule applies on every VPS provider, not just Oracle: traffic must pass the provider’s network firewall (if it has one) and the operating system firewall, and a service must actually be listening on the port. For step-by-step commands for UFW, firewalld and iptables, and how to test a port from outside the server, see our guide on how to open ports on a VPS.

Frequently Asked Questions (FAQ)

Why does Oracle Cloud block ports by default?
Oracle Cloud Infrastructure uses a zero-trust, security-first default profile. By blocking all ingress traffic except SSH (port 22), Oracle prevents unhardened cloud instances from being compromised immediately upon deployment.

Can I use Network Security Groups (NSGs) instead of Security Lists?
Yes. While Security Lists apply rules to all instances within a VCN Subnet, Network Security Groups (NSGs) allow you to apply ingress/egress firewall rules to specific Virtual Network Interface Cards (VNICs). Both work effectively for opening ports 80 and 443.

Why does UFW fail to open ports on Oracle Ubuntu images?
Oracle's official Ubuntu cloud images include pre-populated iptables rules in the INPUT chain with a trailing REJECT rule. Because raw iptables rules process sequentially before ufw user chains, standard ufw allow commands are ignored unless rules are explicitly inserted using iptables -I INPUT ....

Does Oracle Cloud block outbound SMTP Port 25?
Yes, Oracle Cloud Infrastructure blocks outbound traffic on TCP port 25 by default across all Free Tier and paid tenancies to prevent spam. To send emails from your web applications, use transactional email providers like SendGrid, Mailgun, or Amazon SES over port 587 or HTTPS APIs.

How do I attach a custom domain and free SSL (Certbot) after opening ports 80 and 443?
Once ports 80 and 443 are open, point your domain's DNS A Record to your Oracle Public IP. Then, install Certbot by running sudo apt install certbot python3-certbot-nginx and obtain a free Let's Encrypt SSL certificate by executing sudo certbot --nginx -d yourdomain.com. Certbot requires port 80 to complete the ACME HTTP-01 challenge verification.

Advanced Firewall Diagnostics: Troubleshooting Persistent Connection Drops

Even after configuring both OCI Ingress Security Lists and host-level iptables rules, network engineers frequently encounter edge cases where HTTP/HTTPS connections continue to time out. The three most common culprits are Ubuntu's default UFW (Uncomplicated Firewall) conflicting with iptables, OCI Network Security Groups (NSGs) overriding regional Security Lists, and incorrect NGINX bind directives.

To identify whether network packets are successfully crossing the OCI Virtual Cloud Network gateway into your server, run an active packet capture session directly on your server interface:

# Monitor incoming TCP traffic on port 80 and 443
sudo tcpdump -nn -i any port 80 or port 443

If tcpdump displays incoming SYN packets from your client IP address but fails to show outgoing SYN-ACK responses, your web server daemon (NGINX, Apache, or LiteSpeed) is either stopped or listening exclusively on the loopback address (127.0.0.1) rather than all network interfaces (0.0.0.0).

# Verify which ports and interfaces your web server is actively listening on
sudo ss -tulpn | grep -E ':(80|443)'

Once your ports are cleanly accessible from the public internet, the immediate next step is binding your custom domain and establishing automated SSL encryption. Follow our step-by-step walkthrough on pointing custom domains and installing free Let's Encrypt SSL certificates.

Prefer not to manage the server yourself? Compare RackUp’s hosting plans: Cloud WordPress hosting starts at $2.49 a month.

Automating Security Rule Audits with Nmap and Shell Automation

Once you have opened ports 80 and 443 across your Oracle VCN and iptables firewall layers, establishing automated external port monitoring ensures that future configuration drift or package updates do not silently lock your visitors out of your website. Unintended firewall resets are particularly common when installing third-party management packages that overwrite /etc/iptables/rules.v4.

You can verify port accessibility externally from any remote terminal using nmap or netcat (nc):

# Scan web ports from an external workstation
nmap -p 80,443 -Pn <YOUR_ORACLE_PUBLIC_IP>

# Quick TCP handshake check via Netcat
nc -zv -w 3 <YOUR_ORACLE_PUBLIC_IP> 80
nc -zv -w 3 <YOUR_ORACLE_PUBLIC_IP> 443

If the scan reports open, your dual-layer firewall architecture is functioning as designed. If it returns filtered, the connection is being dropped at the OCI VCN Security List level before reaching your instance. If it reports closed, the packets are reaching your Linux instance, but no web server daemon is actively listening on that socket. Checking your open ports regularly helps you catch firewall changes before they cause downtime.