Get started now or speak directly with our engineering team for specialized assistance.
The most frustrating moment for developers launching an Oracle Cloud Free Tier instance is completing a fresh Nginx, Apache, or Docker installation, verifying that the web service status is active (running), and then being greeted by a blank ERR_CONNECTION_TIMED_OUT screen in their web browser.
If you have spent hours troubleshooting Nginx virtual hosts, restarting systemd services, or checking domain DNS records to no avail, you are not alone. Oracle Cloud Infrastructure (OCI) is engineered with a strict Security-First architecture. Unlike standard virtual private servers (VPS) where web ports are open by default, Oracle Cloud enforces a mandatory two-layer security firewall. To allow external HTTP (port 80) and HTTPS (port 443) web traffic to reach your server, you must open ports at both the cloud network perimeter and inside the virtual machine's Linux operating system.
If you are setting up an instance for hosting CMS platforms like WordPress, make sure to read our complete step-by-step guide on Setting up WordPress on Oracle Cloud Free Tier.
Need high-performance cloud hosting without the manual firewall configuration headaches? For businesses and developers managing client infrastructure, manual cloud security configurations can lead to unexpected downtime. Discover how RackUp IT provides hassle-free managed hosting in our analysis on Web Hosting for Growing Businesses or explore our Managed Cloud & Web Hosting Services.
Why do standard Linux tutorials fail when applied to Oracle Cloud? The answer lies in Oracle's dual-layer defense model:
Layer 1: OCI Virtual Cloud Network (VCN) Ingress Rules: This is the cloud-level perimeter firewall managed via the Oracle Cloud Console. It acts as the outer gate of your cloud datacenter. By default, Oracle blocks all incoming public traffic except SSH (port 22).
Layer 2: Guest Operating System Firewall (iptables / netfilter-persistent): This is the internal software firewall running inside your Linux instance (Ubuntu, Debian, or Oracle Linux). Oracle's official OS images come pre-configured with strict iptables rules that reject incoming traffic on unapproved ports—even if you disable ufw!
To successfully serve websites or APIs, traffic must pass through both layers. If either layer remains closed, external requests will result in a connection timeout.
First, we must instruct Oracle Cloud Infrastructure's network perimeter firewall to allow inbound TCP packets on web ports 80 and 443.
Log into your Oracle Cloud Console.
Open the navigation menu and go to Compute > Instances. Click on your active instance name.
Under the Instance Details page, scroll down to the Primary VNIC section and click on the link for your Subnet.
Inside the Subnet details page, click on your Security List (typically named Default Security List for...).
Click the Add Ingress Rules button and fill in the following parameters for HTTP:
Source Type: CIDR
Source CIDR: 0.0.0.0/0 (Allows traffic from any IP address on the internet)
IP Protocol: TCP
Source Port Range: (Leave empty)
Destination Port Range: 80,443 (or add separate rules for port 80 and port 443)
Description: Allow Inbound Web Traffic (HTTP and HTTPS)
Click Add Ingress Rules to save changes.
Pro Tip: OCI Security Lists are stateful by default. This means when an incoming HTTP request is allowed in on port 80 or 443, the outbound response is automatically permitted without requiring separate egress rules.
Now that the cloud perimeter gate is open, we must configure the Linux operating system inside your Virtual Machine to accept traffic on ports 80 and 443. Check out our Managed Shared WordPress hosting
Oracle's official Ubuntu images utilize raw iptables rules managed by netfilter-persistent. Running standard commands like sudo ufw allow 80/tcp often fails because existing iptables REJECT rules take precedence.
Connect to your server via SSH and execute the following commands in sequence:
# Insert ACCEPT rule for Port 80 (HTTP) before the default REJECT rule
sudo iptables -I INPUT 6 -p tcp --dport 80 -j ACCEPT
# Insert ACCEPT rule for Port 443 (HTTPS) before the default REJECT rule
sudo iptables -I INPUT 6 -p tcp --dport 443 -j ACCEPT
# Save the updated iptables rules permanently so they survive server reboots
sudo netfilter-persistent save
# Reload the netfilter-persistent service
sudo netfilter-persistent reloadIf your instance runs Oracle Linux or Red Hat Enterprise Linux, the default firewall manager is firewalld. Run the following commands via SSH:
# Add HTTP and HTTPS services to the public firewall zone
sudo firewall-cmd --permanent --zone=public --add-service=http
sudo firewall-cmd --permanent --zone=public --add-service=https
# Reload firewalld to apply changes
sudo firewall-cmd --reloadOnce both the OCI Console Security List and local OS firewall rules are updated, verify your server's accessibility using these diagnostic steps:
Test Local HTTP Listener: Run curl -I http://localhost on your server terminal. You should receive an HTTP/1.1 200 OK or HTTP/1.1 301 Moved Permanently header response.
Test Public Connectivity: Open a browser on your local computer or smartphone and visit http://<YOUR_ORACLE_PUBLIC_IP>. If your web server welcome page loads, your ports are officially open!
Port Probe Command: From your local computer terminal, run a network probe:
nc -zv <YOUR_ORACLE_PUBLIC_IP> 80 443A successful connection will return Connection to <YOUR_ORACLE_PUBLIC_IP> 80 port [tcp/http] succeeded!
Click the button below to learn more and get started.
If you are still experiencing connection failures, check these three common pitfalls:
Difference Between "Connection Refused" and "Connection Timed Out":
Connection Timed Out: Indicates that firewall rules (OCI Security List or OS iptables) are still actively dropping incoming packets. Review Steps 1 and 2.
Connection Refused: Means the firewall is open, but no web server daemon (Nginx, Apache, or Docker container) is listening on port 80/443. Run sudo systemctl status nginx or sudo netstat -tulpn | grep LISTEN to confirm your service is running.
Rules Lost After Server Reboot: If your ports close after restarting your instance, you forgot to save your iptables state. Always run sudo netfilter-persistent save after modifying iptables rules.
Cloudflare / Proxy Conflicts: If you are routing traffic through Cloudflare, ensure your DNS A record is pointed to the correct Oracle Public IP and that your Cloudflare SSL/TLS setting is set to Full or Full (Strict).
Why does Oracle Cloud block ports by default?
Oracle Cloud Infrastructure uses a zero-trust, security-first default profile. By blocking all ingress traffic except SSH (port 22), Oracle prevents unhardened cloud instances from being compromised immediately upon deployment.
Can I use Network Security Groups (NSGs) instead of Security Lists?
Yes. While Security Lists apply rules to all instances within a VCN Subnet, Network Security Groups (NSGs) allow you to apply ingress/egress firewall rules to specific Virtual Network Interface Cards (VNICs). Both work effectively for opening ports 80 and 443.
Why does UFW fail to open ports on Oracle Ubuntu images?
Oracle's official Ubuntu cloud images include pre-populated iptables rules in the INPUT chain with a trailing REJECT rule. Because raw iptables rules process sequentially before ufw user chains, standard ufw allow commands are ignored unless rules are explicitly inserted using iptables -I INPUT ....
Does Oracle Cloud block outbound SMTP Port 25?
Yes, Oracle Cloud Infrastructure blocks outbound traffic on TCP port 25 by default across all Free Tier and paid tenancies to prevent spam. To send emails from your web applications, use transactional email providers like SendGrid, Mailgun, or Amazon SES over port 587 or HTTPS APIs.
How do I attach a custom domain and free SSL (Certbot) after opening ports 80 and 443?
Once ports 80 and 443 are open, point your domain's DNS A Record to your Oracle Public IP. Then, install Certbot by running sudo apt install certbot python3-certbot-nginx and obtain a free Let's Encrypt SSL certificate by executing sudo certbot --nginx -d yourdomain.com. Certbot requires port 80 to complete the ACME HTTP-01 challenge verification.
Unsure Which Cloud Hosting Plan Fits Your Site?
Answer 4 quick diagnostic questions to calculate your exact server CPU, RAM, and NVMe SSD hardware requirements with transparent pricing.
Cloud Infrastructure Engineer and technical writer specializing in VPS setups and network configurations.
Hosting & SEOLearn how shared server slowdowns, noisy neighbors, and high TTFB harm your Core Web Vitals, causing Google to demote your website in organic search rankings.
Server StackA technical benchmark comparison evaluating LiteSpeed Enterprise LSCache against Nginx for high-concurrency WordPress and web application hosting.
E-CommerceDiscover exact vCPU, RAM, and NVMe hardware specifications needed to run a fast WooCommerce store with zero checkout slowdowns.