0

On my LAN, all the websites hosted on the nginx machine load fine. When outside of the LAN, they usually don't load at all, and if they do it takes several clicks of the refresh button and several minutes to load the image. Pages with CSS seem to not load at all from outside LAN. When outside of the LAN, but connected to the VPN, everything works fine. Nginx error log doesn't show any errors. The access log look the same for requests from the LAN and requests from the internet.

I'm running nginx 1.2.1, on Debian Wheezy

Here's the nginx conf:

user www-data;
worker_processes 4;
pid /var/run/nginx.pid;

events {
worker_connections 768;
# multi_accept on;
}

http {

    ##
    # Basic Settings
    ##

    sendfile on;
    tcp_nopush on;
    tcp_nodelay on;
    keepalive_timeout 65;
    types_hash_max_size 2048;
    # server_tokens off;

    # server_names_hash_bucket_size 64;
    # server_name_in_redirect off;

    include /etc/nginx/mime.types;
    default_type application/octet-stream;

    ##
    # Logging Settings
    ##

    access_log /var/log/nginx/access.log;
    error_log /var/log/nginx/error.log;

    ##
    # Gzip Settings
    ##

    gzip on;
    gzip_disable "msie6";

    # gzip_vary on;
    # gzip_proxied any;
    # gzip_comp_level 6;
    # gzip_buffers 16 8k;
    # gzip_http_version 1.1;
    # gzip_types text/plain text/css application/json application/x-javascript text/xml >application/xml application/xml+rss text/javascript;
    ##
    # nginx-naxsi config
    ##
    # Uncomment it if you installed nginx-naxsi
    ##

    #include /etc/nginx/naxsi_core.rules;

    ##
    # nginx-passenger config
    ##
    # Uncomment it if you installed nginx-passenger
    ##

    #passenger_root /usr;
    #passenger_ruby /usr/bin/ruby;

    ##
    # Virtual Host Configs
    ##

    include /etc/nginx/conf.d/*.conf;
    include /etc/nginx/sites-enabled/*;

# See: https://community.qualys.com/blogs/securitylabs/2013/08/05/configuring-apache->nginx-and-openssl-for-forward-secrecy
    # This MUST come AFTER the lines that includes .../sites-enabled/*, otherwise    SSLv3 >support may be re-enabled accidentally.
    include perfect-forward-secrecy.conf;
}

And the site in question .vhost (this applies to all vhosts, and all are similar to this config):

server {
        listen *:80;

        listen *:443 ssl;
        ssl_certificate /var/www/clients/client1/web2/ssl/domain.com.crt;
        ssl_certificate_key /var/www/clients/client1/web2/ssl/domain.com.key;

        server_name domain.com www.domain.com;

#        if ($ssl_protocol = "") {
#                rewrite ^       https://$server_name$request_uri? permanent;
#        }

        root   /var/www/domain.com/web;



        index index.html index.htm index.php index.cgi index.pl index.xhtml;


        location ~ \.shtml$ {
            ssi on;
        }


        error_page 400 /error/400.html;
        error_page 401 /error/401.html;
        error_page 403 /error/403.html;
        error_page 404 /error/404.html;
        error_page 405 /error/405.html;
        error_page 500 /error/500.html;
        error_page 502 /error/502.html;
        error_page 503 /error/503.html;
        recursive_error_pages on;
        location = /error/400.html {

            internal;
        }
        location = /error/401.html {

            internal;
        }
        location = /error/403.html {

            internal;
        }
        location = /error/404.html {

            internal;
        }
        location = /error/405.html {

            internal;
        }
        location = /error/500.html {

            internal;
        }
        location = /error/502.html {

            internal;
        }
        location = /error/503.html {

            internal;
        }

        error_log /var/log/ispconfig/httpd/domain.com/error.log;
        access_log /var/log/ispconfig/httpd/domain.com/access.log combined;

        location ~ /\. {
            deny all;
            access_log off;
            log_not_found off;
        }

        location = /favicon.ico {
            log_not_found off;
            access_log off;
        }

        location = /robots.txt {
            allow all;
            log_not_found off;
            access_log off;
        }

        location /stats/ {

            index index.html index.php;
            auth_basic "Members Only";
            auth_basic_user_file /var/www/clients/client1/web2/web/stats/.htpasswd_stats;
        }

        location ^~ /awstats-icon {
            alias /usr/share/awstats/icon;
        }

        location ~ \.php$ {
            try_files /ae8f1ab378db095df6da2b73d9d970b5.htm @php;
        }

        location @php {
            try_files $uri =404;
            include /etc/nginx/fastcgi_params;
            fastcgi_pass unix:/var/lib/php5-fpm/web2.sock;
            fastcgi_index index.php;
            fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
            fastcgi_intercept_errors on;
        }

        location /cgi-bin/ {
            try_files $uri =404;
            include /etc/nginx/fastcgi_params;
            root /var/www/clients/client1/web2;
            gzip off;
            fastcgi_pass  unix:/var/run/fcgiwrap.socket;
            fastcgi_index index.cgi;
            fastcgi_param SCRIPT_FILENAME  $document_root$fastcgi_script_name;
            fastcgi_intercept_errors on;
        }
}

The server, with a LAN ip of 192.168.15.33, sites behind a firewall. On the firewall I've tried flushing the rules, and setting them back in one at a time. Here is the rule file that gets loaded at boot:

# Generated by iptables-save v1.4.14 on Thu Jun  5 07:54:47 2014
*filter
:INPUT ACCEPT [0:0]
:FORWARD ACCEPT [128367:93659631]
:OUTPUT ACCEPT [11855:3741587]

-A INPUT -i lo -j ACCEPT
-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
-A INPUT -i eth0 -p udp -m udp --dport 20091 -j ACCEPT
-A INPUT -i eth0 -p udp -m udp --dport 20092 -j ACCEPT
-A INPUT -i eth0 -p udp -m udp --dport 20093 -j ACCEPT
-A INPUT -i eth1 -j ACCEPT
-A INPUT -i tun0 -j ACCEPT
-A INPUT -i tun1 -j ACCEPT
-A INPUT -i tun2 -j ACCEPT
-A INPUT -p icmp -j ACCEPT
-A INPUT -i eth0 -j DROP


-A FORWARD -i eth0 -p tcp -m tcp --dport 25 -m state --state NEW -j ACCEPT
-A FORWARD -i eth0 -p tcp -m tcp --dport 587 -m state --state NEW -j ACCEPT
-A FORWARD -i eth0 -p tcp -m tcp --dport 995 -m state --state NEW -j ACCEPT
-A FORWARD -i eth0 -p tcp -m tcp --dport 143 -m state --state NEW -j ACCEPT
-A FORWARD -i eth0 -p tcp -m tcp --dport 5222 -m state --state NEW -j ACCEPT
-A FORWARD -i eth0 -p udp -m udp --dport 5222 -m state --state NEW -j ACCEPT
-A FORWARD -i eth0 -p tcp -m tcp --dport 80 -m state --state NEW -j ACCEPT
-A FORWARD -i eth0 -p tcp -m tcp --dport 443 -m state --state NEW -j ACCEPT
-A FORWARD -i eth0 -p tcp -m tcp --dport 19983 -m state --state NEW -j ACCEPT
-A FORWARD -i eth0 -p udp -m udp --dport 19984 -m state --state NEW -j ACCEPT
-A FORWARD -i eth0 -p tcp -m tcp --dport 7777 -m state --state NEW -j ACCEPT
COMMIT
# Completed on Thu Jun  5 07:54:47 2014
# Generated by iptables-save v1.4.14 on Thu Jun  5 07:54:47 2014
*nat
:PREROUTING ACCEPT [7015750:481018493]
:INPUT ACCEPT [1286947:100210418]
:OUTPUT ACCEPT [1606496:123095807]
:POSTROUTING ACCEPT [6831463:714772610]
-A PREROUTING -i eth0 -p tcp -m tcp --dport 25 -j DNAT --to-destination 192.168.15.33:25
-A PREROUTING -i eth0 -p tcp -m tcp --dport 587 -j DNAT --to-destination 192.168.15.33:587
-A PREROUTING -i eth0 -p tcp -m tcp --dport 995 -j DNAT --to-destination 192.168.15.33:995
-A PREROUTING -i eth0 -p tcp -m tcp --dport 143 -j DNAT --to-destination 192.168.15.33:143
-A PREROUTING -i eth0 -p tcp -m tcp --dport 5222 -j DNAT --to-destination 192.168.15.33:5222
-A PREROUTING -i eth0 -p udp -m udp --dport 5222 -j DNAT --to-destination 192.168.15.33:5222
-A PREROUTING -i eth0 -p tcp -m tcp --dport 80 -j DNAT --to-destination 192.168.15.33:80
-A PREROUTING -i eth0 -p tcp -m tcp --dport 443 -j DNAT --to-destination 192.168.15.33:443
-A PREROUTING -i eth0 -p tcp -m tcp --dport 7777 -j DNAT --to-destination 192.168.15.33:7777
-A PREROUTING -i eth0 -p tcp -m tcp --dport 19983 -j DNAT --to-destination 192.168.15.109:19983
-A PREROUTING -i eth0 -p udp -m udp --dport 19984 -j DNAT --to-destination 192.168.15.109:19984
-A POSTROUTING -o eth0 -j MASQUERADE
-A POSTROUTING -o tun0 -j MASQUERADE
-A POSTROUTING -o tun1 -j MASQUERADE
-A POSTROUTING -o tun2 -j MASQUERADE
COMMIT
# Completed on Thu Jun  5 07:54:47 2014

I'm not sure if this is a firewall issue, an nginx issue, or something else, or even the next step to take towards figuring this out.

  • 1
    What kind of Internet connection do you have ? Maybe a poor one... – krisFR Aug 9 '14 at 13:58
  • My upstream is 5Mbps. The pages load just fine for clients outside the LAN if they're connected to the VPN. It's just for the non-VPN clients outside the LAN where this problem emerges. – kitchenblock Aug 9 '14 at 14:00
  • 1
    From a client outside your LAN, make a test using e.g Chrome and its debug tool (F12 key), and see if you have some timeouts loading some web pages. – krisFR Aug 9 '14 at 16:05
  • Thanks for the suggestion. I just tried that, and the Network tab of the debug tool didn't show a timeout, it just kept loading. I was trying to load a 112K jpeg. I took a screenshot and uploaded it to imgur.com/q52zgVG. – kitchenblock Aug 10 '14 at 0:44
  • Would you mind to provide your domain name so that i could check by myself ? – krisFR Aug 10 '14 at 0:47

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.