I am trying to use a NLB to route traffic to EC2 instances in a private subnet, but the target instances are labeled as “Unhealthy” by the NLB. Here is what I am trying to do:

I want clients from outside my VPC to be able to access a WebSockets server running on my EC2 instance that is located in a private subnet.

The listener on the NLB is using TCP on port 80, and I want it to route traffic to via TCP on port 8443 of the EC2. The security group of the NLB and the EC2 are the same.

Here are the things I have tried:

1. Updated the route table from the private subnet to the ENI of the NLB.
2. Ensured the security group allows inbound traffic from the security group attached to the NLB.
3. Ensured the security group allows all outbound traffic.
4. Ensured that the NACL of the subnet allows inbound and outbound traffic on ports 80 and ports 8443.

I am completely lost as to what the issue might be.