Timeout accessing Amazon EC2 machine from outside even with security group allowing everything

how are you?

I have a question regarding external access to my (dockerized or not) application.

I have a simple ping-pong socket communication using socket.io with the following code files:

server.js

let Server = require('socket.io')

const io = new Server().attach(8090)

io.on('connection', (socket) => {
  console.log('connection')
  socket.on('message', (msg) => {
    console.log('< ' + msg)
    console.log('> pong')
    socket.emit('event', 'pong')
  })
})

client.js

let host = process.argv[2]
let io = require("socket.io-client");

let client = io.connect(`http://${host}`)

let connected = false
client.on('connect', () => {
  connected = true
})

client.on('event', (msg) => {
  console.log('< ' + msg)
  ping()
})


function ping () {
  if (!connected) { 
    setTimeout(ping, 1000)
  } else {
    setTimeout(() => {
      console.log('> ping')
      client.emit('message', 'ping'); 
    }, 1000)
  }
}
ping()

with my server up and running, I can execute the client to test the communication like so:

$ node client.js localhost:8090

and the output is similar to this:

> ping
< pong
> ping
< pong
> ping
< pong
... and so on

Everything works normally when I test this (both client and server) outside my EC2 machine, but when I deploy the server.js to the cloud and run it, I can't reach it from outside.

When I bind a nginx web service on port 80 or 81 and proxy every request to the application, everything starts working fine from outside the cloud, but still does not work on other ports.

My security group is fully open (for testing purposes) (inbound and outbound allowing all traffic from and to anywhere (0.0.0.0/0, ::/0) on all ports) (screenshot attached).

Things that may be useful for troubleshooting:

• When I try a NodeJS http server (without nginx) using node on the same port, it does not work either (works only on 80 and 81)
• I am sure my machine is on the 'fully-open-insecure' security group with all traffic allowed.
• My application is binding to all addresses because I can connect to it using the public address or localhost from inside the cloud machine.
• It only works on port 80 and 81 when I proxy_pass connections from a nginx web server that is on the same machine as the NodeJS application

any help or troubleshooting suggestion will be very appreciated.

thank you very much for your time

Below is a screenshot with the security group definitions:

via lucaschain