0

Most/many visitors to the site https://example.org get a connection timeout. Some visitors get through, possibly ones redirected from http://example.org or those who've previously visited the site.

I'm trying to determine if this is a firewall issue or an nginx configuration issue.

Firewall

I'm using UFW as a firewall, which has the following rules:

To                         Action      From
--                         ------      ----
SSH                        ALLOW       Anywhere                  
Nginx Full                 ALLOW       Anywhere                  
80/tcp                     ALLOW       Anywhere                  
443/tcp                    ALLOW       Anywhere                  
SSH (v6)                   ALLOW       Anywhere (v6)             
Nginx Full (v6)            ALLOW       Anywhere (v6)             
80/tcp (v6)                ALLOW       Anywhere (v6)             
443/tcp (v6)               ALLOW       Anywhere (v6) 

I could give some relevant rules from iptables if anyone needs that, but I'd need some direction on what to look for.

For sudo netstat -anop | grep LISTEN | grep ':443' I get

tcp        0      0 0.0.0.0:443             0.0.0.0:*               LISTEN      120907/nginx: worke  off (0.00/0/0)
tcp6       0      0 :::443                  :::*                    LISTEN      120907/nginx: worke  off (0.00/0/0)

Not sure what "worke off" means.

nginx

It's a virtual host with the server name myservername.com which serves up two websites, example.org and example.com/directory. Example.org points to a docker container running eXist-db. Example.com/directory is serving up a directory on localhost:8080 proxied from another server where example.com lives. Example.com/directory is running smoothly on https when I access it in the browser -- I presume this is because it actually talks to the example.com host over http.

Example.org and myservername.com both have certs from let's encrypt generated by certbot.

When I try nmap from my local machine I get some results I can't explain. Notice the discrepancy between ports 80 and ports 443 and between IPv4 and IPv6

$ nmap -A -T4 -p443 example.org
443/tcp filtered https
$ nmap -A -T4 -p443 my.server.ip.address
443/tcp filtered https
$ nmap -A -T4 -p443 -6 my:server:ip::v6:address
443/tcp open  ssl/http nginx 1.10.3
$ nmap -A -T4 -p80 example.org
80/tcp open  http    nginx 1.10.3
$ nmap -A -T4 -p80 my.server.ip.address
80/tcp open  http    nginx 1.10.3

My nginx.conf is

user www-data;
worker_processes auto;
pid /run/nginx.pid;
include /etc/nginx/modules-enabled/*.conf;

events {
        worker_connections 768;
        # multi_accept on;
}

http {

        ##
        # Basic Settings
        ##

        client_max_body_size 50M;
        sendfile on;
        tcp_nopush on;
        tcp_nodelay on;
        keepalive_timeout 65;
        types_hash_max_size 2048;
        # server_tokens off;

        server_names_hash_bucket_size 64;
        # server_name_in_redirect off;

        include /etc/nginx/mime.types;
        default_type application/octet-stream;

        ##
        # SSL Settings
        ##

        ssl_protocols TLSv1 TLSv1.1 TLSv1.2; # Dropping SSLv3, ref: POODLE
        ssl_prefer_server_ciphers on;

        ##
        # Logging Settings
        ##

        access_log /var/log/nginx/access.log;
        error_log /var/log/nginx/error.log;

        ##
        # Gzip Settings
        ##

        gzip on;
        gzip_disable "msie6";

        # gzip_vary on;
        # gzip_proxied any;
        # gzip_comp_level 6;
        # gzip_buffers 16 8k;
        # gzip_http_version 1.1;
        # gzip_types text/plain text/css application/json application/javascript text/xml application/xml application/xml+rss text/javascript;

        ##
        # Virtual Host Configs
        ##

        include /etc/nginx/conf.d/*.conf;
        include /etc/nginx/sites-enabled/*;
}

and my nginx server blocks:

server {
        listen 80 default_server;
        listen [::]:80 default_server;

        server_name _ myservername.com;
        return 301 https://myservername.com$request_uri;
}

server {
        # SSL configuration
        #
        listen 443 ssl default_server;
        listen [::]:443 ssl default_server;
        
        server_name _ myservername.com;

        location / {
            proxy_set_header Host $host;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_pass http://localhost:8080;
       }

        ssl_certificate /etc/letsencrypt/live/myservername.com/fullchain.pem;
        ssl_certificate_key /etc/letsencrypt/live/myservername.com/privkey.pem;
}

server {
        listen 80;
        listen [::]:80;

        server_name example.com www.example.com;

        gzip off;

        location / {
                proxy_set_header Host $host;
                proxy_set_header X-Real-IP $remote_addr;
                proxy_pass http://localhost:8080;
        }
}

server {
       listen 80;
       listen [::]:80;

       server_name example.org www.example.org;
       return 301 https://example.org$request_uri;
}

server {

        # SSL configuration
        #
        listen 443 ssl;
        listen [::]:443 ssl;
        
        server_name example.org www.example.org;

        gzip off;

        location / {
                proxy_set_header Host $host;
                proxy_set_header X-Real-IP $remote_addr;
                proxy_pass http://docker.container.ip.address:port/exist/apps/example/;
        }

        location /workshop2020/ {
                return 302 http://example.org/forum2020/;
        }


    location /exist/apps/example/ { 
            rewrite ^/exist/apps/example/(.*)$ /$1; 
    }


    ssl_certificate /etc/letsencrypt/live/example.org/fullchain.pem; # managed by Certbot
    ssl_certificate_key /etc/letsencrypt/live/example.org/privkey.pem; # managed by Certbot

}

Very grateful for any help!!

1

2 Answers 2

1

It turns out it was the firewall, not nginx. Although I'm using ufw as my firewall, there was a preexisting INPUT DROP rule in iptables (but not in ip6tables) that was catching https requests.

Thanks to Francis Daly over in the nginx forums who explained how to identify whether the https request to port 443 was even getting to nginx.

I disabled IPv6 in my browser and then tried loading the site. By looking at tcpdump while trying to load the site, I was able to see what was happening with the requests -- $ sudo tcpdump -nnSX -v port 443 showed a bunch of packets with Flags [S]. Thus the request was getting to the machine but there was no handshake.

Comparing this to the nginx access log, I was able to see that the request didn't get to nginx at all.

So I examined iptables more carefully and found the offending rule.

0

Please also note that some hosters/cloud providers have an additional hardware-level/external firewall, often enabled by default (with SSH port 22 the only allowed port), that also needs to be configured (e.g. Hetzner; Ionos; OVH; ...)!

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.