Let us say I have an EC2 VM which we will call V in security group S1. I have an EFS mount point which we will call M in security group S2. Everything is in the same VPC, on the same subnet, in the same availability zone. I have allowed TCP port 2049 inbound on S2 from S1. Both SGs have outbound everything. Yet V times out when attempting to mount M. Cloudwatch shows REJECT OK from the IP address of V to that of M.

Everything looks to me to be as the docs describe it ought to be but I am obviously missing something, where else can I look to dig into this?


Cloudwatch shows REJECT OK from the IP address of V to that of M.

That means your VPC is blocking traffic from V to M and this traffic was blocked by NACLs or a Security Group. That log entry you quoted should tell you the network interface on which that traffic was blocked. Refer to this documentation for more information on how to read VPC Flow Logs. You should take a look at that network interface (ENI) and look at the security groups or NACLs attached to it.

There are 4 reasons why you might be getting time out errors when trying to mount EFS:

  1. Security Groups not allowing inbound traffic on port 2049 from the EFS Security Group.
  2. You have NACLs blocking that traffic.
  3. You have a firewall running inside your instance that is blocking that traffic.
  4. Your network configs and routing (on either your EC2 instance or VPC) is misconfigured.
  5. Issues with the EFS or EC2 service (very unlikely but you will see the relevant error messages like failed status checks, etc. if this is the case)

If you are using more "complex" set ups like mounting your EFS to a machine outside the VPC then you would have to extend your troubleshooting accordingly. AWS also has documentation on troubleshooting EFS.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.