0

netstat output:

tcp        0      0 0.0.0.0:80              0.0.0.0:*               LISTEN      -               
tcp        0      0 0.0.0.0:22              0.0.0.0:*               LISTEN      -               
tcp        0      0 127.0.0.1:5432          0.0.0.0:*               LISTEN      -               
tcp        0      0 0.0.0.0:443             0.0.0.0:*               LISTEN      -               
tcp        0      0 0.0.0.0:3306            0.0.0.0:*               LISTEN      -    

UFW is inactive. The website is hosted on a droplet at Digital Ocean, they allow all the ports. If i run tcpdump and try accessing the website, it shows a connection but the browser returns a refused to connect error. Nma p on localhost shows port 443 is open, but if i run it on the actual server it shows it is closed. Nginx is listening correctly on port 443 as shown above.

Nginx.conf

user admin root;
worker_processes auto;

error_log  /var/log/nginx/error.log debug;
pid        /var/run/nginx.pid;
events {
        worker_connections 1024;
}

http {
    include       /etc/nginx/mime.types;
    default_type  application/octet-stream;

    log_format  main  '$remote_addr - $remote_user [$time_local] "$request" '
                      '$status $body_bytes_sent "$http_referer" '
                      '"$http_user_agent" "$http_x_forwarded_for"'
                        '$ssl_protocol/$ssl_cipher ';

    access_log  /var/log/nginx/access.log  main;

    sendfile        on;
    #tcp_nopush     on;

    keepalive_timeout  65;

    #gzip  on;
    ssl_session_cache   shared:SSL:10m;
    ssl_session_timeout 10m;

    include /etc/nginx/conf.d/*.conf;
}

Server blocks

server {
    listen       80;
    listen 443 ssl;
    server_name  vechi.juristnet.ro;
    ssl_certificate /etc/letsencrypt/live/juristnet.ro/fullchain.pem;
     ssl_certificate_key /etc/letsencrypt/live/juristnet.ro/privkey.pem;

    root /var/juristnet/stable;

    location / {
        index  index.php index.html;
        rewrite_log on;
        rewrite ^\/([a-zA-Z-]*)\/?([a-zA-Z-]*)$ /index.php?page=$1&subpage=$2 last;
    }

    location /.well-known/{
        allow all;
}
    location ~ \.php$ {
        fastcgi_keep_conn on;
        fastcgi_pass unix:/var/run/php/php7.0-fpm.sock;
        fastcgi_index  index.php;
        fastcgi_param  SCRIPT_FILENAME $document_root$fastcgi_script_name;
        include        /etc/nginx/fastcgi_params;
    }

}


server {
    listen 80;

    server_name  juristnet.ro www.juristnet.ro;

    root /var/test/proiect;
    client_max_body_size 10M;

    location = /favicon.ico
    {
        access_log off; log_not_found off;
                alias /var/test/proiect/favicon.ico;
    }

    location /static/
    {
        autoindex on;
    }

        location /assets/
    {
                autoindex on;
                alias /var/test/proiect/assets/;
    }

        location  ~ /.well-known/
    {
                allow all;
    }

    location / {
        include /etc/nginx/fastcgi_params;
            proxy_set_header X-Real-IP  $remote_addr;
            proxy_set_header X-Forwarded-For $remote_addr;
            proxy_set_header X-Forwarded-Proto $scheme;
                    proxy_set_header Host $http_host;
         proxy_pass http://unix:/var/test/proiect/Tutorial2.sock;
         fastcgi_param   HTTPS               on;
             fastcgi_param   HTTP_SCHEME         https;


     }
 }

EDIT: netstat -tulepn

Active Internet connections (only servers)
Proto Recv-Q Send-Q Local Address           Foreign Address         State       User       Inode       PID/Program name
tcp        0      0 0.0.0.0:80              0.0.0.0:*               LISTEN      0          7246832     8864/nginx.conf 
tcp        0      0 0.0.0.0:22              0.0.0.0:*               LISTEN      0          12588       1003/sshd       
tcp        0      0 127.0.0.1:5432          0.0.0.0:*               LISTEN      109        13486       1131/postgres   
tcp        0      0 0.0.0.0:443             0.0.0.0:*               LISTEN      0          7246833     8864/nginx.conf 
tcp        0      0 0.0.0.0:3306            0.0.0.0:*               LISTEN      108        15831       1067/mysqld     
tcp6       0      0 :::8080                 :::*                    LISTEN      107        18201       1356/java       
tcp6       0      0 :::22                   :::*                    LISTEN      0          12594       1003/sshd       
tcp6       0      0 :::30845                :::*                    LISTEN      0          14246       1207/docker-proxy

TCPdump output:

listening on eth0, link-type EN10MB (Ethernet), capture size 65535 bytes
16:28:15.632611 IP 82.208.159.43.60840 > 46.101.111.197.https: Flags [S], seq 419699944, win 29200, options [mss 1380,sackOK,TS val 17904800 ecr 0,nop,wscale 7], length 0
16:28:15.632776 IP 82.208.159.43.24434 > 46.101.111.197.https: Flags [S], seq 1740044749, win 29200, options [mss 1380,sackOK,TS val 17904800 ecr 0,nop,wscale 7], length 0
16:28:15.632940 IP 46.101.111.197.https > 82.208.159.43.60840: Flags [R.], seq 0, ack 419699945, win 0, length 0
16:28:15.632964 IP 46.101.111.197.https > 82.208.159.43.24434: Flags [R.], seq 0, ack 1740044750, win 0, length 0

Update: iptables -t nat -L -v -n

Chain PREROUTING (policy ACCEPT 2106 packets, 120K bytes)
 pkts bytes target     prot opt in     out     source               destination         
 2604  148K DOCKER     all  --  *      *       0.0.0.0/0            0.0.0.0/0            ADDRTYPE match dst-type LOCAL

Chain INPUT (policy ACCEPT 2084 packets, 118K bytes)
 pkts bytes target     prot opt in     out     source               destination         

Chain OUTPUT (policy ACCEPT 16610 packets, 1025K bytes)
 pkts bytes target     prot opt in     out     source               destination         
 7017  421K DOCKER     all  --  *      *       0.0.0.0/0           !127.0.0.0/8          ADDRTYPE match dst-type LOCAL

Chain POSTROUTING (policy ACCEPT 17125 packets, 1055K bytes)
 pkts bytes target     prot opt in     out     source               destination         
    0     0 MASQUERADE  all  --  *      !docker0  172.17.0.0/16        0.0.0.0/0           
    0     0 MASQUERADE  tcp  --  *      *       172.17.0.2           172.17.0.2           tcp dpt:80
    0     0 MASQUERADE  tcp  --  *      *       172.17.0.2           172.17.0.2           tcp dpt:443

Chain DOCKER (2 references)
 pkts bytes target     prot opt in     out     source               destination         
    0     0 RETURN     all  --  docker0 *       0.0.0.0/0            0.0.0.0/0           
    0     0 DNAT       tcp  --  !docker0 *       0.0.0.0/0            0.0.0.0/0            tcp dpt:30845 to:172.17.0.2:80
  515 29760 DNAT       tcp  --  !docker0 *       0.0.0.0/0            0.0.0.0/0            tcp dpt:443 to:172.17.0.2:443
  • What are the corresponding log-entries in nginx server log? Does it happen on all servers? – Lenniey Feb 8 '17 at 14:08
  • access log and error log doesn't show anything related to https. There is another droplet running apache, and it uses https without problem. So I am assuming it's not an external firewall problem. – Dani Mateo Feb 8 '17 at 14:09
  • @DaniMateo HTTP is working correctly. Could you post a netstat -tulpen to see if it really is nginx listening on 443? Also: are there any packets returned from the server using HTTPs in tcpdump? Or are only incoming requests traced? – Lenniey Feb 8 '17 at 14:23
  • I updated the question with the outputs. – Dani Mateo Feb 8 '17 at 14:29
  • Check iptables -t nat -L -n -v and iptables -L -n -v on your server hosting docker (and maybe on the docker container again). – Lenniey Feb 8 '17 at 14:39
1

This is not a solution for everybody, but in my case it had something to do with Docker. I didn't use it for my website, but I think it still interferred with the connection somehow. I stopped the service and it works now. I could have made it to work by adding some rules to expose the port, but this did it.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.