2

Nginx will not listen on ipv4 port 443. It listens on ipv4/6 port 80 and ipv6 port 443 but not ipv4 port 443.

Debian Stretch 9.8 - currently updated

Installed nginx-full package with apt

root@loadbalance01:/etc/nginx# nginx -v
nginx version: nginx/1.10.3

After doing:

systemctl stop nginx
systemctl start nginx

root@loadbalance01:/etc/nginx# !166
netstat -anop | grep LISTEN | grep nginx
tcp        0      0 0.0.0.0:80              0.0.0.0:*               LISTEN      13533/nginx: master  off (0.00/0/0)
tcp6       0      0 :::80                   :::*                    LISTEN      13533/nginx: master  off (0.00/0/0)
tcp6       0      0 :::443                  :::*                    LISTEN      13533/nginx: master  off (0.00/0/0)

Conspicuously absent is port 443 on tcp.

Just to be sure nothing else is listening on tcp 443

root@loadbalance01:/etc/nginx# netstat -anop | grep LISTEN | grep ':443'
tcp6       0      0 :::443                  :::*                    LISTEN      13533/nginx: master  off (0.00/0/0)

Nope only tcp6.

The only errors in /var/log/nginx/error.log are old errors that have been corrected.

nginx -t
nginx: the configuration file /etc/nginx/nginx.conf syntax is ok
nginx: configuration file /etc/nginx/nginx.conf test is successful

My config:

I am just trying to create a simple load balancer with 1 node till I can show this works.

nginx.conf Note this is only modified by removing the sites-enabled line, I am using a conf.d config.

user www-data;
worker_processes auto;
pid /run/nginx.pid;
include /etc/nginx/modules-enabled/*.conf;

events {
    worker_connections 768;
    # multi_accept on;
}

http {

    ##
    # Basic Settings
    ##

    sendfile on;
    tcp_nopush on;
    tcp_nodelay on;
    keepalive_timeout 65;
    types_hash_max_size 2048;
    # server_tokens off;

    # server_names_hash_bucket_size 64;
    # server_name_in_redirect off;

    include /etc/nginx/mime.types;
    default_type application/octet-stream;

    ##
    # SSL Settings
    ##

    ssl_protocols TLSv1 TLSv1.1 TLSv1.2; # Dropping SSLv3, ref: POODLE
    ssl_prefer_server_ciphers on;

    ##
    # Logging Settings
    ##

    access_log /var/log/nginx/access.log;
    error_log /var/log/nginx/error.log;

    ##
    # Gzip Settings
    ##

    gzip on;
    gzip_disable "msie6";

    # gzip_vary on;
    # gzip_proxied any;
    # gzip_comp_level 6;
    # gzip_buffers 16 8k;
    # gzip_http_version 1.1;
    # gzip_types text/plain text/css application/json application/javascript text/xml application/xml application/xml+rss text/javascript;

    ##
    # Virtual Host Configs
    ##

    include /etc/nginx/conf.d/*.conf;
}

The only other file modified is:

root@loadbalance01:/etc/nginx# cat conf.d/loadbalance.conf

upstream example {
    server 192.168.1.250;
}

server {
    server_name example.com

    listen 443 ssl;
    listen [::]:443 ssl;

    ssl on;

    ssl_certificate /etc/letsencrypt/live/example.com/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/example.com/privkey.pem;

    location / {
        proxy_pass http://example;
    }
}

server {
    listen 80 default_server;
    listen [::]:80 default_server;

    server_name _;

    return 301 https://example.com;
}

NOTE: renamed to example.com

4
  • 1
    With linux by default, when a process listens on the ipv6 port, ipv4 connections will also come into that socket. So a separate listener on ipv4 is not needed and probably not even possible because of this.
    – wurtel
    Commented Apr 25, 2019 at 7:46
  • I tried a telnet 192.168.1.249 443 from another server on the same lan and it says connection refused.
    – Bodger
    Commented Apr 25, 2019 at 19:28
  • 3
    You’ve missed semicolon after server_name directive, so you don’t have listen 443 ssl directive, but instead you have weird server names listen, 443 and ssl.
    – Alexey Ten
    Commented Apr 25, 2019 at 20:10
  • 1
    And, btw, you don’t need ssl on
    – Alexey Ten
    Commented Apr 25, 2019 at 20:12

3 Answers 3

1

Thanx to Alexy Ten,

The configuration was missing a semi colon after the server name directive. It passed syntax check, but was still wrong.

Thanx

0

I have not had huge experience with nginx but i have used the following configuration file successfully for reverse proxying / load balancing. Hopefully something in this will help you

# HTTP Server redirect to HTTPS
server {
    listen 80;
    server_name <WEB_NAME>.example.com;
    return 301 https://$host$request_uri;
}

# HTTPS Server
server {
    listen 443;
    server_name <WEB_NAME>.example.com;

    # It is best to place the root of the server block at the server level, and not the location level
    # any location block path will be relative to this root. 
    root /site/<WEB_NAME>;

    access_log /var/log/nginx/<WEB_NAME>.access.log;
    error_log /var/log/nginx/<WEB_NAME>.error.log;

    ssl on;
    ssl_certificate /etc/nginx/ssl/<WEB_NAME>/example.com.cer;
    ssl_certificate_key /etc/nginx/ssl/<WEB_NAME>/example.com.nopass.key;
    ssl_protocols TLSv1.1 TLSv1.2; # don't use SSLv3 ref: POODLE
    ssl_session_cache  builtin:1000  shared:SSL:10m;
    ssl_ciphers HIGH:!aNULL:!eNULL:!EXPORT:!CAMELLIA:!DES:!MD5:!PSK:!RC4;
    ssl_prefer_server_ciphers on;


    location / {
        proxy_pass http://backend/;
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "upgrade";
        proxy_set_header Host $http_host;

        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forward-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forward-Proto http;
        proxy_set_header X-Nginx-Proxy true;

        proxy_redirect off;
    }
}


# Uncomment other server entries if Loadbalance Configuration is required
upstream backend {
    server 127.0.0.1:80;
#    server <BACKEND_SERVER2>:<PORT>;
#    server <BACKEND_SERVER3>:<PORT>;
}

**NOTE: also renamed to example.com ;)

0

In my case 443 was blocked on an instance networking level on Lightsail. Had to go to it's settings and allow it.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .